## Overview

On February 20, 2026, CISA added two RoundCube Webmail vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog under Binding Operational Directive (BOD) 22-01, requiring Federal Civilian Executive Branch (FCEB) agencies to remediate. Both vulnerabilities have confirmed active exploitation in the wild.

## CVE-2025-49113 — Post-Auth RCE via PHP Object Deserialization (CVSS 9.9)

### Vulnerability Details

RoundCube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the `_from` parameter in a URL is not validated in `program/actions/settings/upload.php`, leading to PHP Object Deserialization. This vulnerability was reported by Kirill Firsov and published by FearsOff research.

The vulnerability exists in the file upload handler within RoundCube's settings module. The `_from` parameter, intended to indicate the source page of the upload request, is passed directly to PHP's `unserialize()` function without validation. An authenticated attacker can craft a malicious serialized PHP object that, when deserialized, triggers arbitrary code execution on the server via PHP magic methods (__wakeup, __destruct, __toString) and existing gadget chains in the RoundCube codebase or its dependencies.

### Attack Requirements - **Authentication required**: The attacker needs a valid RoundCube session (any user-level account) - **No user interaction**: Once authenticated, exploitation is automated - **Network accessible**: RoundCube webmail is typically internet-facing on ports 80/443 - **Low complexity**: Serialized PHP payloads are well-documented, and tools like PHPGGC provide ready-made gadget chains

### Impact - Full remote code execution on the web server as the web server user (typically www-data or apache) - Access to all email accounts on the server (mail spool, IMAP credentials) - Lateral movement to database server (RoundCube stores sessions and contacts in MySQL/PostgreSQL) - Potential privilege escalation if web server process has elevated permissions - Webshell deployment for persistent access

### CVSS - **MITRE Score**: 9.9 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - **NVD Score**: 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

### Affected Versions - RoundCube Webmail < 1.5.10 - RoundCube Webmail 1.6.0 through 1.6.10 - Debian Linux 11 (ships vulnerable RoundCube package)

### Fixed Versions - RoundCube 1.5.10 (released June 1, 2025) - RoundCube 1.6.11 (released June 1, 2025)

## CVE-2025-68461 — Stored XSS via SVG Animate Tag (CVSS 7.2)

### Vulnerability Details

RoundCube Webmail before 1.5.12 and 1.6.x before 1.6.12 is vulnerable to Cross-Site Scripting (XSS) via the animate tag in an SVG document. This vulnerability was reported by Valentin T. from CrowdStrike.

The vulnerability exists in RoundCube's HTML sanitizer, which fails to properly handle SVG `<animate>` elements. An attacker can embed a malicious SVG document in an email that contains an `<animate>` tag with event handlers or attribute manipulation that executes JavaScript in the context of the victim's browser session when the email is viewed.

### Attack Requirements - **No authentication required**: Attacker sends a crafted email to the victim - **User interaction**: Victim must open/view the malicious email in RoundCube webmail - **Network accessible**: Email delivery to the target RoundCube instance

### Impact - Session cookie theft (RoundCube session tokens) - Credential harvesting via fake login forms injected into the webmail interface - Email content exfiltration (read victim's emails via JavaScript) - Account takeover by stealing session tokens - Chaining with CVE-2025-49113: XSS provides the initial foothold (stolen credentials or session) to authenticate and exploit the deserialization RCE

### CVSS - **MITRE Score**: 7.2 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) - **NVD Score**: 6.1 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

### Affected Versions - RoundCube Webmail < 1.5.12 - RoundCube Webmail 1.6.0 through 1.6.11

### Fixed Versions - RoundCube 1.5.12 (released December 13, 2025) - RoundCube 1.6.12 (released December 13, 2025)

## Chained Exploitation Scenario

These two vulnerabilities represent a complete compromise chain:

1. **Phase 1 — XSS (CVE-2025-68461)**: Attacker sends a crafted email containing a malicious SVG with an animate tag to a target user. When the victim views the email, JavaScript executes and steals the session cookie or captures credentials via a fake login overlay.

2. **Phase 2 — Authentication**: Attacker uses the stolen session cookie or credentials to authenticate to RoundCube as the victim.

3. **Phase 3 — RCE (CVE-2025-49113)**: With an authenticated session, the attacker exploits the deserialization vulnerability in the settings upload handler, sending a crafted serialized PHP object via the _from parameter to achieve remote code execution on the server.

4. **Phase 4 — Post-Exploitation**: Full server access — webshell deployment, email spool access, lateral movement to database, credential harvesting from IMAP configuration.

## Nation-State Context

RoundCube has been a repeated target for nation-state actors:

- **Winter Vivern / TAG-70**: Exploited CVE-2023-5631 (XSS) to target European government and military email systems in 2023. Campaign documented by ESET, targeting Ukrainian and European entities. - **APT28 / Fancy Bear**: Exploited CVE-2020-35730 (XSS) in campaigns against Ukrainian government email servers in 2022-2023, documented by Recorded Future. - **Pattern**: Both CVEs follow the same attack pattern — XSS via email rendering to steal sessions, followed by post-exploitation. The current active exploitation of CVE-2025-49113 and CVE-2025-68461 likely follows the same nation-state playbook.

## Remediation

### Immediate Actions - Update to RoundCube 1.6.12 or 1.5.12 (patches both CVEs) - If immediate patching is not possible, restrict access to RoundCube webmail via VPN or IP allowlisting - Review web server logs for exploitation indicators (anomalous POST to settings/upload.php with serialized data in _from parameter) - Review webmail access logs for session anomalies (session reuse from different IPs) - Check for webshells in the RoundCube web root and temp directories

### Long-Term Defenses - Implement WAF rules to block serialized PHP objects in URL parameters - Enable Content-Security-Policy headers to mitigate XSS impact - Migrate to a supported, actively maintained webmail solution if running EOL versions - Implement MFA for webmail access - Network segmentation — isolate webmail servers from internal network - Subscribe to RoundCube security announcements for timely patching