Roundcube RCE Exploit (CVE-2025-49113)

A fully functional proof-of-concept exploit for CVE-2025-49113

---

🧠 Summary

CVE-2025-49113 is an The vulnerability is the result of a logic flaw in the application's session parser, which allows insecure deserialization of PHP objects. Authenticated users can exploit this issue to execute arbitrary commands on the server.

---

🔥 Impact

An attacker with valid credentials (even low-privileged user accounts) can exploit this flaw to:

• Execute arbitrary system commands.
• Establish reverse shells or deploy persistence.
• Move laterally within the internal network if Roundcube is self-hosted.

---

🧩 Vulnerability Details

• Type: Insecure Deserialization → Remote Code Execution
• Component: PHP backend (mail processing or plugin loading logic)
• Conditions: Authenticated session (cookie or login), crafted serialized payload
• Exploit Primitive: PHP unserialize() with attacker-controlled input and loaded gadgets

---

✅ Affected Versions

• 1.5.x: All versions from to