--- title: "Roundcube CVE-2025-49113 RCE and SVG XSS: Both Exploited" url: https://erroneo.us/security/briefs/roundcube-cve-2025-49113-post-auth-rce/ description: "Roundcube post-auth RCE (fixed 1.6.11/1.5.10) and SVG XSS (fixed 1.6.12/1.5.12) are in KEV, and the RCE was still used in 2026. Go to 1.6.20/1.7.5." type: security-brief section: "Security Digest" date_published: 2025-06-01 date_modified: 2026-10-23 publisher: erroneo.us author: erroneo.us Security Desk verdict: "Check exposure" cves: ["CVE-2025-49113", "CVE-2025-68461"] severity: "critical" exploited: "in-the-wild" kev: true license: All rights reserved. Quote with attribution and a link. --- # Roundcube CVE-2025-49113 RCE and SVG XSS: Both Exploited **Verdict: Check exposure.** Any Roundcube below 1.6.12 is exposed to an exploited RCE and XSS pair that is still used against mail servers in 2026; upgrade to 1.6.20 or 1.7.5 and hunt for web shells on anything that ran older versions. - **Who must act:** Anyone running self-hosted Roundcube below 1.6.12 or 1.5.12, including copies bundled in cPanel, Plesk, ISPConfig or DirectAdmin, and anyone still on the unsupported 1.5 branch. - **Who can relax:** Roundcube installs kept current on 1.6.x or 1.7.x since December 2025, and organizations that do not run Roundcube. - **Affected:** Roundcube before 1.5.10 and 1.6.0-1.6.10 (CVE-2025-49113; back to 1.1.0 per the discoverer); Roundcube before 1.5.12 and 1.6.0-1.6.11 (CVE-2025-68461); Roundcube copies bundled by hosting panels until their vendors update - **Fixed:** Roundcube 1.6.11 / 1.5.10 (CVE-2025-49113, Jun 1, 2025); Roundcube 1.6.12 / 1.5.12 (CVE-2025-68461, Dec 13, 2025); Recommended: Roundcube 1.6.20 or 1.7.5 (Oct 19, 2026) - **CVEs:** CVE-2025-49113, CVE-2025-68461 - **CISA KEV:** yes · **Exploitation:** Exploited in the wild ## What to do 1. Inventory every Roundcube, including hosting-panel bundles, and record its version. 2. Upgrade to Roundcube 1.6.20 or 1.7.5; 1.6.12 is the minimum for these two CVEs. 3. Migrate any 1.5 install to 1.6 or 1.7; the 1.5 series is no longer supported. 4. Require MFA or strong, rate-limited logins for webmail, since the RCE needs only an ordinary account. 5. Hunt for web shells and odd processes on any server that ran a vulnerable version after June 2025. ### How to check if you are affected - Search web logs for POSTs to _task=settings&_action=upload whose _from value contains '!' or %21. - Look for plugins/newmail_notifier/mail_preview.php, which is not part of Roundcube and is where Proofpoint found the SquareShell web shell. - Check hosts for /tmp/log_de.log, a user process named [kworker/0:2], and traffic to 45.150.109[.]151, 194.213.18[.]133 or 45.86.229[.]111. - Search stored HTML mail for SVG animate elements with attributeName set to xlink:href. ## What happened On February 20, 2026, CISA added two Roundcube Webmail bugs to KEV, with a March 13 deadline ([CVE-2025-49113](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49113), [CVE-2025-68461](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68461)). **CVE-2025-49113** is remote code execution for any logged-in user. Roundcube fixed it in 1.6.11 and 1.5.10 on June 1, 2025, crediting Kirill Firsov ([notice](https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10)). The `_from` URL parameter in `program/actions/settings/upload.php` was not validated, which leads to PHP object deserialization ([CVE record](https://www.cve.org/CVERecord?id=CVE-2025-49113)). Firsov's [write-up](https://fearsoff.org/research/roundcube) traces it to 1.1.0 and says it works on default installs, including cPanel and Plesk bundles. He published early, he says, because attackers had "diffed and weaponized the vulnerability within 48 hours" and an exploit was being sold on underground forums. The CNA scores it CVSS 3.1 9.9; [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-49113) gives 8.8. **CVE-2025-68461** is an email XSS, fixed in 1.6.12 and 1.5.12 on December 13, 2025 and reported by Valentin T. of CrowdStrike ([notice](https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12)). The sanitizer did not strip the namespace from an SVG ``, so a message could turn a link into a `javascript:` URL ([fix](https://github.com/roundcube/roundcubemail/commit/bfa032631c36b900e7444dfa278340b33cbf7cdb)). The CNA scores it 7.2 with no user interaction; [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-68461) gives 6.1 and assumes a click. ## Who is affected Roundcube below 1.6.12 or 1.5.12 has the XSS; below 1.6.11 or 1.5.10 it also has the RCE ([CVE record](https://www.cve.org/CVERecord?id=CVE-2025-68461)). Panel and distribution copies count too. A week after the June fix, Shadowserver still counted about 84,900 unpatched instances ([BleepingComputer](https://www.bleepingcomputer.com/news/security/over-84-000-roundcube-instances-vulnerable-to-actively-exploited-flaw/)). Since 1.7.0 shipped in May 2026, the 1.5.x series "is no longer supported and maintained" ([announcement](https://roundcube.net/news/2026/05/10/roundcube-1.7.0-released)). ## Do you really need to act? If you have been on 1.6.12 or later since December, you only need to stay current. Otherwise, yes. CISA did not say whose exploitation it saw. Coverage of the listing named no campaign for either CVE ([The Hacker News](https://thehackernews.com/2026/02/cisa-adds-two-actively-exploited.html)). The public record before then was an exploit for sale within days of the patch and a public proof of concept. After the listing, Proofpoint reported that a cluster it calls UNK_MassTraction, assessed with moderate confidence as China-aligned, had attacked US and Canadian universities since May 2026 ([Proofpoint](https://www.proofpoint.com/us/blog/threat-insight/one-email-closer-edge-unkmasstraction-physics-exploitation)). The emails used an older Roundcube XSS, CVE-2024-42009, to steal credentials, then used CVE-2025-49113 to plant a PHP web shell. That chain, from email XSS to stolen session to server, is the pattern to fear. CVE-2025-68461 is the same class of email XSS. As of Oct 23, 2026, no public report names a campaign using it. ## What to do now 1. Inventory every Roundcube, panel bundles included. Check Settings > About, or run `grep RCMAIL_VERSION program/include/iniset.php`. 2. Upgrade to 1.6.20 or 1.7.5. They also close the "!"-prefixed session-key primitive the RCE abused ([notice](https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5)). 3. Move 1.5 installs to 1.6 or 1.7. 4. Enforce MFA or rate-limited logins. Any ordinary account can trigger the RCE. 5. Hunt on any server that ran a vulnerable version after June 2025. ## How to tell if you were hit - Search web logs for POSTs to `_task=settings&_action=upload` whose `_from` contains `!` or `%21`. - Look for `plugins/newmail_notifier/mail_preview.php`. It is not a Roundcube file; Proofpoint found the SquareShell web shell there, timestomped to blend in. - Check for `/tmp/log_de.log`, a user process named `[kworker/0:2]` (the VShell loader), and traffic to 45.150.109[.]151, 194.213.18[.]133 or 45.86.229[.]111. - Search stored HTML mail for `