Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization | CVE-2025-48745

Kirill Firsov discovered a Post-authentication RCE in Roundcube Webmail (v1.1.0 till current 1.6.10) that has existed unnoticed for 10 years, and which affects over 53 Million hosts (and tools like cPanel, Plesk, ISPConfig, DirectAdmin, etc.).

POC is not available yet.

[+] https://fearsoff.org/research/roundcube

https://www.youtube.com/watch?v=TBkTbMJWHJY

YouTube

Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization [CVE-2025-49113] PoC demonstration

Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization.
There may be some confusion, as MITRE, for some reason, published a second CVE-2025-49113 for the same bug - after CVE-2025-48745, which I submitted long ago. Now it's CVE-2025-49113 #cve #roundcube…