Executive brief
Roundcube Webmail, a widely used open-source email client, contains a critical security flaw that allows attackers to take full control of the mail server. By sending a specially crafted web request, an authenticated user can execute malicious commands on the underlying system. This vulnerability is currently being exploited in the wild and could lead to total data theft or service disruption.
Technical details
A PHP Object Deserialization vulnerability exists in Roundcube Webmail's 'upload.php' component due to insufficient validation of the '_from' URL parameter. An authenticated attacker can exploit this by providing a malicious serialized object, which the application then processes, leading to arbitrary remote code execution (RCE). The vulnerability affects versions prior to 1.5.10 and the 1.6.x branch prior to 1.6.11. This flaw is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation. Patches are available in versions 1.5.10 and 1.6.11.
Affected products
- Roundcube Webmail before 1.5.10, 1.6.x before 1.6.11
Timeline
- 2025-06-01: patched: Vendor released security updates 1.6.11 and 1.5.10
- 2025-12-22: disclosed: Initial NVD analysis published
- 2026-02-20: kev added: CISA added to Known Exploited Vulnerabilities catalog