CVE-2025-49113 – Roundcube Webmail RCE Exploit (Python PoC)

CVE ID: CVE-2025-49113
Exploit Type: Remote Code Execution (via PHP Object Injection)
Application: Roundcube Webmail ≤ 1.5.9 and ≤ 1.6.10
Exploit Language: Python
Author: 00xCanelo
Status: Tested and Working on Vulnerable Roundcube Installations

---

📌 Description

This exploit leverages a vulnerability in how Roundcube Webmail handles uploaded image filenames which are unserialized as PHP objects. By crafting a malicious payload that triggers a Crypt_GPG_Engine deserialization chain, remote command execution can be achieved post-authentication.

This Python PoC mimics the attack chain used by the public PHP exploit, but with cleaner logic, optional logging, and ease of usage in offensive tooling setups.

---

🚧 Prerequisites

• Vulnerable Roundcube version (≤1.5.9 or ≤1.6.10)
• Valid user credentials on Roundcube
• Python 3.x environment
• pip install requests

---

🚀 Exploitation Steps