erroneo.us
Search all guides⌘K

Security Digest · Jun 1, 2025 · Vulnerability · Other

Roundcube CVE-2025-49113 RCE and SVG XSS: Both Exploited

Roundcube post-auth RCE (fixed 1.6.11/1.5.10) and SVG XSS (fixed 1.6.12/1.5.12) are in KEV, and the RCE was still used in 2026. Go to 1.6.20/1.7.5.

Published By erroneo.us Security Desk · Updated 3 min read15 sources

Our verdict

Check exposure

Any Roundcube below 1.6.12 is exposed to an exploited RCE and XSS pair that is still used against mail servers in 2026; upgrade to 1.6.20 or 1.7.5 and hunt for web shells on anything that ran older versions.

Who must act: Anyone running self-hosted Roundcube below 1.6.12 or 1.5.12, including copies bundled in cPanel, Plesk, ISPConfig or DirectAdmin, and anyone still on the unsupported 1.5 branch.

Who can relax: Roundcube installs kept current on 1.6.x or 1.7.x since December 2025, and organizations that do not run Roundcube.

Affected
Roundcube before 1.5.10 and 1.6.0-1.6.10 (CVE-2025-49113; back to 1.1.0 per the discoverer)
Roundcube before 1.5.12 and 1.6.0-1.6.11 (CVE-2025-68461)
Roundcube copies bundled by hosting panels until their vendors update
Fixed in
Roundcube 1.6.11 / 1.5.10 (CVE-2025-49113, Jun 1, 2025)
Roundcube 1.6.12 / 1.5.12 (CVE-2025-68461, Dec 13, 2025)
Recommended: Roundcube 1.6.20 or 1.7.5 (Oct 19, 2026)
CVSS
9.9 (v3.1, CNA)
EPSS
99.0% (percentile 99.9)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Inventory every Roundcube, including hosting-panel bundles, and record its version.
  2. Upgrade to Roundcube 1.6.20 or 1.7.5; 1.6.12 is the minimum for these two CVEs.
  3. Migrate any 1.5 install to 1.6 or 1.7; the 1.5 series is no longer supported.
  4. Require MFA or strong, rate-limited logins for webmail, since the RCE needs only an ordinary account.
  5. Hunt for web shells and odd processes on any server that ran a vulnerable version after June 2025.

How to check if you are affected or compromised

  • Search web logs for POSTs to _task=settings&_action=upload whose _from value contains '!' or %21.
  • Look for plugins/newmail_notifier/mail_preview.php, which is not part of Roundcube and is where Proofpoint found the SquareShell web shell.
  • Check hosts for /tmp/log_de.log, a user process named [kworker/0:2], and traffic to 45.150.109[.]151, 194.213.18[.]133 or 45.86.229[.]111.
  • Search stored HTML mail for SVG animate elements with attributeName set to xlink:href.

What happened#

On February 20, 2026, CISA added two Roundcube Webmail bugs to KEV, with a March 13 deadline (CVE-2025-49113, CVE-2025-68461).

CVE-2025-49113 is remote code execution for any logged-in user. Roundcube fixed it in 1.6.11 and 1.5.10 on June 1, 2025, crediting Kirill Firsov (notice). The _from URL parameter in program/actions/settings/upload.php was not validated, which leads to PHP object deserialization (CVE record). Firsov's write-up traces it to 1.1.0 and says it works on default installs, including cPanel and Plesk bundles. He published early, he says, because attackers had "diffed and weaponized the vulnerability within 48 hours" and an exploit was being sold on underground forums. The CNA scores it CVSS 3.1 9.9; NVD gives 8.8.

CVE-2025-68461 is an email XSS, fixed in 1.6.12 and 1.5.12 on December 13, 2025 and reported by Valentin T. of CrowdStrike (notice). The sanitizer did not strip the namespace from an SVG <animate attributeName="xlink:href">, so a message could turn a link into a javascript: URL (fix). The CNA scores it 7.2 with no user interaction; NVD gives 6.1 and assumes a click.

Who is affected#

Roundcube below 1.6.12 or 1.5.12 has the XSS; below 1.6.11 or 1.5.10 it also has the RCE (CVE record). Panel and distribution copies count too. A week after the June fix, Shadowserver still counted about 84,900 unpatched instances (BleepingComputer). Since 1.7.0 shipped in May 2026, the 1.5.x series "is no longer supported and maintained" (announcement).

Do you really need to act?#

If you have been on 1.6.12 or later since December, you only need to stay current. Otherwise, yes.

CISA did not say whose exploitation it saw. Coverage of the listing named no campaign for either CVE (The Hacker News). The public record before then was an exploit for sale within days of the patch and a public proof of concept. After the listing, Proofpoint reported that a cluster it calls UNK_MassTraction, assessed with moderate confidence as China-aligned, had attacked US and Canadian universities since May 2026 (Proofpoint). The emails used an older Roundcube XSS, CVE-2024-42009, to steal credentials, then used CVE-2025-49113 to plant a PHP web shell. That chain, from email XSS to stolen session to server, is the pattern to fear. CVE-2025-68461 is the same class of email XSS. As of Oct 23, 2026, no public report names a campaign using it.

What to do now#

  1. Inventory every Roundcube, panel bundles included. Check Settings > About, or run grep RCMAIL_VERSION program/include/iniset.php.
  2. Upgrade to 1.6.20 or 1.7.5. They also close the "!"-prefixed session-key primitive the RCE abused (notice).
  3. Move 1.5 installs to 1.6 or 1.7.
  4. Enforce MFA or rate-limited logins. Any ordinary account can trigger the RCE.
  5. Hunt on any server that ran a vulnerable version after June 2025.

How to tell if you were hit#

  • Search web logs for POSTs to _task=settings&_action=upload whose _from contains ! or %21.
  • Look for plugins/newmail_notifier/mail_preview.php. It is not a Roundcube file; Proofpoint found the SquareShell web shell there, timestomped to blend in.
  • Check for /tmp/log_de.log, a user process named [kworker/0:2] (the VShell loader), and traffic to 45.150.109[.]151, 194.213.18[.]133 or 45.86.229[.]111.
  • Search stored HTML mail for <animate with attributeName="xlink:href".

If you find a shell, rebuild the server, rotate the database credentials and des_key in config/config.inc.php, and reset user passwords.

Timeline#

  • — Roundcube 1.6.11 and 1.5.10 fix CVE-2025-49113.
  • — FearsOff publishes its write-up and proof of concept, citing exploit sales.
  • — Shadowserver counts about 84,900 unpatched instances.
  • — Roundcube 1.6.12 and 1.5.12 fix CVE-2025-68461.
  • — CISA adds both CVEs to KEV.
  • — Roundcube 1.7.0 ships, and the 1.5 series loses support.
  • — Proofpoint reports UNK_MassTraction using CVE-2025-49113.
  • — Roundcube 1.6.20 and 1.7.5 harden the session primitive.

Vulnerability records

  • CVE-2025-49113 · KEV 2026-02-20 · Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not…
  • CVE-2025-68461 · KEV 2026-02-20 · Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Roundcube — Security updates 1.6.11 and 1.5.10 (Jun 1, 2025) roundcube.net
  2. Roundcube — Security updates 1.6.12 and 1.5.12 (Dec 13, 2025) roundcube.net
  3. Roundcube GitHub — Fix Cross-Site-Scripting vulnerability via SVG's animate tag github.com
  4. CVE record — CVE-2025-49113 cve.org
  5. CVE record — CVE-2025-68461 cve.org
  6. NVD — CVE-2025-49113 nvd.nist.gov
  7. NVD — CVE-2025-68461 nvd.nist.gov
  8. CISA — Known Exploited Vulnerabilities: CVE-2025-49113 cisa.gov
  9. CISA — Known Exploited Vulnerabilities: CVE-2025-68461 cisa.gov
  10. FearsOff — Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization fearsoff.org
  11. Proofpoint — One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation proofpoint.com
  12. Roundcube — Roundcube 1.7.0 released (May 10, 2026) roundcube.net
  13. Roundcube — Security updates 1.6.20 and 1.7.5 (Oct 19, 2026) roundcube.net

Coverage and analysis

  1. BleepingComputer — Over 84,000 Roundcube instances vulnerable to actively exploited flaw bleepingcomputer.com
  2. The Hacker News — CISA adds two actively exploited Roundcube flaws to KEV (Feb 21, 2026) thehackernews.com