CVE-2025-49113: roundcube webmail +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2025-49113

CVSS 8.8 · High KEV · sudah dieksploitasi EPSS 99,0%

Kerentanan Deserialization of Untrusted Data pada roundcube webmail, debian linux. Skor CVSS 3.1 8.8 (High) menurut NVD. Masuk katalog KEV CISA pada 20 Februari 2026, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

Rincian

Terbit di NVD: 2 Juni 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-502: Deserialization of Untrusted Data
EPSS (30 hari): 99,0% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: RoundCube Webmail Deserialization of Untrusted Data Vulnerability
Masuk KEV: 20 Februari 2026
Tenggat CISA: 13 Maret 2026 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
roundcube	webmail	Semua versi sebelum 1.5.10
roundcube	webmail	Versi 1.6.0 hingga sebelum 1.6.11
debian	debian linux	Versi 11.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10 advisory vendor
https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d patch
https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695 patch
https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e patch
https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script exploit · mitigasi · advisory pihak ketiga
https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection exploit · mitigasi · advisory pihak ketiga
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49113 pemerintah AS
https://fearsoff.org/research/roundcube advisory pihak ketiga
http://www.openwall.com/lists/oss-security/2025/06/02/3 mailing list · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2025/06/msg00008.html mailing list · advisory pihak ketiga
https://github.com/roundcube/roundcubemail/pull/9865 issue tracking
https://github.com/roundcube/roundcubemail/releases/tag/1.5.10 release notes
https://github.com/roundcube/roundcubemail/releases/tag/1.6.11 release notes

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.