CVE-2025-49113 – Roundcube Remote Code Execution (RCE) PoC

This repository contains a Proof-of-Concept (PoC) exploit for CVE-2025-49113, a critical remote code execution vulnerability in Roundcube Webmail versions prior to 1.5.10 and 1.6.11. The vulnerability arises from insecure PHP object deserialization in the upload.php script, allowing authenticated users to execute arbitrary code on the server.

⚠️ Disclaimer: This PoC is intended for educational purposes only. Do not use this exploit against systems you do not own or have explicit permission to test. Unauthorized use may be illegal.

Vulnerability Overview

• CVE ID: CVE-2025-49113
• CVSS v3.1 Base Score: 9.9 (Critical)
• Affected Versions:
  • Roundcube 1.5.0 through 1.5.9
  • Roundcube 1.6.0 through 1.6.10
• Vulnerability Type: Remote Code Execution via insecure PHP object deserialization
• Impact: Allows authenticated users to execute arbitrary code on the server

For detailed information, refer to the NVD CVE-2025-49113 entry.

PoC Script: exp.py

The exp.py script demonstrates the exploitation of this vulnerability. It sends a crafted request to the vulnerable upload.php endpoint, triggering the deserialization flaw and executing a specified command on the server.

Requirements

pip -r install requirements.txt

Usage

python3 exp.py <target_url> <username> <password> <command>

Example

python3 exp.py http://mail.website.com admin password "id"

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-49113
• https://github.com/hakaioffsec/CVE-2025-49113-exploit
• https://github.com/fearsoff-org/CVE-2025-49113