Over 84,000 Roundcube Webmail Installations Exposed to Remote Code Vulnerabilities

Security researchers have identified a critical vulnerability in Roundcube Webmail that affects over 84,000 unpatched installations worldwide, according to data from The Shadowserver Foundation.

The vulnerability, designated CVE-2025-49113, enables authenticated attackers to execute arbitrary code remotely and has already been exploited in targeted attacks potentially conducted by state actors.

The vulnerability affects all Roundcube versions from 1.1.0 through 1.6.10, representing a significant threat to millions of webmail users across educational institutions, government agencies, and commercial hosting providers.

The scope of this vulnerability extends far beyond typical security vulnerabilities, with researchers estimating that over 53 million hosts are potentially affected.

Roundcube has become ubiquitous across the internet infrastructure, bundled by major hosting providers including Hostinger, GoDaddy, Dreamhost, OVH, and Gandi.

The webmail client is also integrated into popular control panels such as cPanel, Plesk, ISPConfig, and DirectAdmin, amplifying the potential impact across shared hosting environments.

Educational and governmental institutions represent particularly high-value targets, with prestigious universities like Johns Hopkins, Columbia University, and the University of Cambridge utilizing Roundcube for their email infrastructure.

This widespread adoption across academia, public service, and high-tech sectors has created what security researchers describe as an “industrial scale” attack surface.

The Shadowserver Foundation’s monitoring indicates that approximately 84,000 installations remain unpatched despite the availability of security updates, creating ongoing exposure to potential exploitation.

Technical Vulnerability

The vulnerability stems from a critical vulnerability in Roundcube’s session handling mechanism, specifically within the rcube_session→unserialize() function.

The issue involves improper parsing of session data when variable names begin with an exclamation mark (!), causing the deserialization process to incorrectly shift pointer positions and corrupt session data.

This session corruption creates opportunities for PHP object injection attacks, ultimately leading to remote code execution.

Attackers can exploit this vulnerability through Roundcube’s file upload functionality, manipulating both the _from GET parameter and uploaded file names to inject malicious serialized objects into user sessions.

The exploitation technique bypasses Web Application Firewall (WAF) detection and requires only valid user credentials to execute.

Security researchers have confirmed that the vulnerability has been “already diffed and weaponized within 48 hours” of the patch becoming publicly available on GitHub, with evidence of exploits being sold in underground forums.

According to Report, Organizations should prioritize updating their Roundcube installations while monitoring for suspicious session activity and file upload patterns that could indicate exploitation attempts.

Immediate Patching

Roundcube has released security updates addressing CVE-2025-49113, with version 1.6.11 available for the latest stable branch and version 1.5.10 for the Long Term Support (LTS) branch.

The patches specifically fix the post-authentication remote code execution vulnerability via PHP object deserialization, as reported by security researcher Kirill Firsov.

Organizations running any version between 1.1.0 and 1.6.10 are considered “sitting ducks” and must update immediately.

The vulnerability’s rapid weaponization has prompted researchers to accelerate public disclosure despite originally planning a longer responsible disclosure window.

Given the active exploitation and the fact that “attackers have already diffed and weaponized the vulnerability,” security experts emphasize that defenders need immediate access to technical details to implement proper protections.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.