# RoundCube Webmail Active Exploitation — CVE-2025-49113 Deserialization RCE (CVSS 9.9) + CVE-2025-68461 XSS via SVG Animate Tag (CISA KEV)

> CISA added two RoundCube Webmail vulnerabilities to the Known Exploited Vulnerabilities catalog on February 20, 2026, based on evidence of active exploitation. CVE-2025-49113 (CVSS 9.9) is a post-authentication remote code execution vulnerability via PHP Object Deserialization in the settings upload handler (_from parameter in program/actions/settings/upload.php). CVE-2025-68461 (CVSS 7.2) is a stored cross-site scripting vulnerability via the SVG animate tag, reported by CrowdStrike. Together t

- **Published:** 2026-02-22T12:00:00Z
- **Last reviewed:** 2026-02-22T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0130
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-roundcube-webmail-kev-rce-tl-2026-0130.webp?v=31e8576f (Threadlinqs threat intel: CVE-2025-49113 RoundCube RCE: Detection & IOCs (TL-2026-0130) — Critical severity, 19 IOCs, 9 detection rules.)
- **ID:** TL-2026-0130
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Actor:** APT28 (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 19
- **CVEs:** CVE-2025-49113, CVE-2025-68461

## Description

## Overview

On February 20, 2026, CISA added two RoundCube Webmail vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog under Binding Operational Directive (BOD) 22-01, requiring Federal Civilian Executive Branch (FCEB) agencies to remediate. Both vulnerabilities have confirmed active exploitation in the wild.

## CVE-2025-49113 — Post-Auth RCE via PHP Object Deserialization (CVSS 9.9)

### Vulnerability Details

RoundCube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the `_from` parameter in a URL is not validated in `program/actions/settings/upload.php`, leading to PHP Object Deserialization. This vulnerability was reported by Kirill Firsov and published by FearsOff research.

The vulnerability exists in the file upload handler within RoundCube's settings module. The `_from` parameter, intended to indicate the source page of the upload request, is passed directly to PHP's `unserialize()` function without validation. An authenticated attacker can craft a malicious serialized PHP object that, when deserialized, triggers arbitrary code execution on the server via PHP magic methods (__wakeup, __destruct, __toString) and existing gadget chains in the RoundCube codebase or its dependencies.

### Attack Requirements
- **Authentication required**: The attacker needs a valid RoundCube session (any user-level account)
- **No user interaction**: Once authenticated, exploitation is automated
- **Network accessible**: RoundCube webmail is typically internet-facing on ports 80/443
- **Low complexity**: Serialized PHP payloads are well-documented, and tools like PHPGGC provide ready-made gadget chains

### Impact
- Full remote code execution on the web server as the web server user (typically www-data or apache)
- Access to all email accounts on the server (mail spool, IMAP credentials)
- Lateral movement to database server (RoundCube stores sessions and contacts in MySQL/PostgreSQL)
- Potential privilege escalation if web server process has elevated permissions
- Webshell deployment for persistent access

### CVSS
- **MITRE Score**: 9.9 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
- **NVD Score**: 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

### Affected Versions
- RoundCube Webmail < 1.5.10
- RoundCube Webmail 1.6.0 through 1.6.10
- Debian Linux 11 (ships vulnerable RoundCube package)

### Fixed Versions
- RoundCube 1.5.10 (released June 1, 2025)
- RoundCube 1.6.11 (released June 1, 2025)

## CVE-2025-68461 — Stored XSS via SVG Animate Tag (CVSS 7.2)

### Vulnerability Details

RoundCube Webmail before 1.5.12 and 1.6.x before 1.6.12 is vulnerable to Cross-Site Scripting (XSS) via the animate tag in an SVG document. This vulnerability was reported by Valentin T. from CrowdStrike.

The vulnerability exists in RoundCube's HTML sanitizer, which fails to properly handle SVG `<animate>` elements. An attacker can embed a malicious SVG document in an email that contains an `<animate>` tag with event handlers or attribute manipulation that executes JavaScript in the context of the victim's browser session when the email is viewed.

### Attack Requirements
- **No authentication required**: Attacker sends a crafted email to the victim
- **User interaction**: Victim must open/view the malicious email in RoundCube webmail
- **Network accessible**: Email delivery to the target RoundCube instance

### Impact
- Session cookie theft (RoundCube session tokens)
- Credential harvesting via fake login forms injected into the webmail interface
- Email content exfiltration (read victim's emails via JavaScript)
- Account takeover by stealing session tokens
- Chaining with CVE-2025-49113: XSS provides the initial foothold (stolen credentials or session) to authenticate and exploit the deserialization RCE

### CVSS
- **MITRE Score**: 7.2 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **NVD Score**: 6.1 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

### Affected Versions
- RoundCube Webmail < 1.5.12
- RoundCube Webmail 1.6.0 through 1.6.11

### Fixed Versions
- RoundCube 1.5.12 (released December 13, 2025)
- RoundCube 1.6.12 (released December 13, 2025)

## Chained Exploitation Scenario

These two vulnerabilities represent a complete compromise chain:

1. **Phase 1 — XSS (CVE-2025-68461)**: Attacker sends a crafted email containing a malicious SVG with an animate tag to a target user. When the victim views the email, JavaScript executes and steals the session cookie or captures credentials via a fake login overlay.

2. **Phase 2 — Authentication**: Attacker uses the stolen session cookie or credentials to authenticate to RoundCube as the victim.

3. **Phase 3 — RCE (CVE-2025-49113)**: With an authenticated session, the attacker exploits the deserialization vulnerability in the settings upload handler, sending a crafted serialized PHP object via the _from parameter to achieve remote code execution on the server.

4. **Phase 4 — Post-Exploitation**: Full server access — webshell deployment, email spool access, lateral movement to database, credential harvesting from IMAP configuration.

## Nation-State Context

RoundCube has been a repeated target for nation-state actors:

- **Winter Vivern / TAG-70**: Exploited CVE-2023-5631 (XSS) to target European government and military email systems in 2023. Campaign documented by ESET, targeting Ukrainian and European entities.
- **APT28 / Fancy Bear**: Exploited CVE-2020-35730 (XSS) in campaigns against Ukrainian government email servers in 2022-2023, documented by Recorded Future.
- **Pattern**: Both CVEs follow the same attack pattern — XSS via email rendering to steal sessions, followed by post-exploitation. The current active exploitation of CVE-2025-49113 and CVE-2025-68461 likely follows the same nation-state playbook.

## Remediation

### Immediate Actions
- Update to RoundCube 1.6.12 or 1.5.12 (patches both CVEs)
- If immediate patching is not possible, restrict access to RoundCube webmail via VPN or IP allowlisting
- Review web server logs for exploitation indicators (anomalous POST to settings/upload.php with serialized data in _from parameter)
- Review webmail access logs for session anomalies (session reuse from different IPs)
- Check for webshells in the RoundCube web root and temp directories

### Long-Term Defenses
- Implement WAF rules to block serialized PHP objects in URL parameters
- Enable Content-Security-Policy headers to mitigate XSS impact
- Migrate to a supported, actively maintained webmail solution if running EOL versions
- Implement MFA for webmail access
- Network segmentation — isolate webmail servers from internal network
- Subscribe to RoundCube security announcements for timely patching

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.002 Spearphishing Link
- T1059.004 Unix Shell
- T1203 Exploitation for Client Execution
- T1204.001 Malicious Link
- T1505.003 Web Shell
- T1098 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1027 Obfuscated Files or Information
- T1070.004 File Deletion
- T1539 Steal Web Session Cookie
- T1056.003 Web Portal Capture
- T1552.001 Credentials In Files
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1087.003 Email Account
- T1550.004 Web Session Cookie
- T1114.001 Local Email Collection
- T1114.002 Remote Email Collection
- T1213 Data from Information Repositories
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1531 Account Access Removal
- T1587.004 Exploits

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Post-RCE Email Spool Exfiltration, Forwarding Persistence, and Lateral Movement** (`TL-2026-0130-SPL-003`)

Detects post-RCE activities: www-data accessing /var/mail/ or Maildir (email collection T1114.001), .forward or Sieve rule modification for persistent email access (T1098), account enumeration via database queries (T1087.003), www-data downloading tools via wget/curl (T1105), and log tampering (T1070.004).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1114.001, T1098, T1087.003, T1105, T1070.004
- **Data sources:** linux_auditd, file_access_logs, process_creation_logs, network_flow_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=os sourcetype="linux:auditd"
| search (user="www-data" OR user="apache")
| eval alert=case(
    match(name, "(/var/mail/|/Maildir/)"), "email_spool_access",
    match(name, "(\.forward|\.sieve|sieve\.d)"), "forwarding_persistence",
    match(exe, "(wget|curl)"), "tool_download",
    match(name, "config\.inc\.php"), "config_harvest",
    match(_raw, "SELECT.*FROM.*users"), "account_enumeration",
    1=1, "other"
)
| where alert!="other"
| table _time, user, exe, name, path, alert
| sort -_time
```

### Microsoft KQL

```kql
let mail_access = DeviceFileEvents
| where Timestamp > ago(24h)
| where InitiatingProcessAccountName in ("www-data", "apache")
| where FolderPath has_any ("/var/mail/", "/Maildir/")
| extend AlertType = "email_spool_access";
let forwarding = DeviceFileEvents
| where Timestamp > ago(24h)
| where InitiatingProcessAccountName in ("www-data", "apache")
| where FileName has_any (".forward", ".sieve")
| extend AlertType = "forwarding_persistence";
let tools = DeviceProcessEvents
| where Timestamp > ago(24h)
| where AccountName in ("www-data", "apache")
| where FileName in ("wget", "curl", "python3")
| extend AlertType = "tool_download";
let exfil = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessAccountName in ("www-data", "apache")
| where RemotePort in (443, 80, 8443, 4443)
| where RemoteIPType == "Public"
| summarize TotalBytes = sum(SentBytes) by RemoteIP, bin(Timestamp, 1h)
| where TotalBytes > 10000000
| extend AlertType = "large_data_exfiltration";
union mail_access, forwarding, tools, exfil
| project Timestamp, AlertType, InitiatingProcessAccountName, FileName, FolderPath, RemoteIP, TotalBytes
| sort by Timestamp desc
```

### Sigma

```yaml
title: Web Server Process Accessing Mail Spool After RoundCube RCE
id: 085addce-fc46-4449-b4a6-9498747ab8da
status: experimental
description: Detects www-data/apache reading /var/mail/ or Maildir — email collection after RoundCube CVE-2025-49113 RCE exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-49113
author: Threadlinqs Team
date: 2026/02/22
tags:
    - attack.collection
    - attack.t1114.001
    - attack.persistence
    - attack.t1098
    - attack.defense_evasion
    - attack.t1070.004
logsource:
    product: linux
    category: file_access
detection:
    selection:
        TargetFilename|contains|any:
            - '/var/mail/'
            - '/Maildir/'
        User|any:
            - 'www-data'
            - 'apache'
    condition: selection
falsepositives:
    - Legitimate mail delivery agents writing to mail spool
    - Backup scripts running as www-data (misconfigured)
level: critical
```

**Known false positives:**

- Legitimate mail delivery agents
- Backup scripts misconfigured as www-data

**Tuning notes:** Monitor /var/mail/ and Maildir access by web server users. Alert on .forward/.sieve changes by non-user processes. Track data volume from mail server to external IPs.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- RoundCube Chained Exploit Detection — SVG XSS Email to Session Hijack to Deserialization RCE (locked: unlock with TL Creds)
- RoundCube Post-RCE Activity — Webshell, Config Credential Harvest, and Email Spool Access (locked: unlock with TL Creds)
- RoundCube Post-Compromise Data Exfiltration, Email Forwarding Persistence, and C2 Communication (locked: unlock with TL Creds)
- Email Containing SVG Animate/Set Tag Targeting RoundCube XSS (CVE-2025-68461) (locked: unlock with TL Creds)
- RoundCube Config File Read by Web Server Process (IMAP/DB Credential Harvest) (locked: unlock with TL Creds)
- Outbound Request from Webmail Session Containing Cookie Data (Session Theft) (locked: unlock with TL Creds)
- RoundCube Deserialization Exploit via settings/upload.php and SVG XSS Email Delivery (locked: unlock with TL Creds)
- RoundCube Session Hijack and Post-RCE Webshell Deployment with Config Credential Harvest (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [CISA Adds Two Known Exploited Vulnerabilities to Catalog (Feb 20, 2026)](https://www.cisa.gov/news-events/alerts/2026/02/20/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [NVD — CVE-2025-49113: RoundCube Deserialization RCE](https://nvd.nist.gov/vuln/detail/CVE-2025-49113)
- [NVD — CVE-2025-68461: RoundCube XSS via SVG Animate](https://nvd.nist.gov/vuln/detail/CVE-2025-68461)
- [RoundCube Security Updates 1.6.11 and 1.5.10 (CVE-2025-49113 fix)](https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10)
- [RoundCube Security Updates 1.6.12 and 1.5.12 (CVE-2025-68461 fix)](https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12)
- [FearsOff Research — RoundCube Post-Auth RCE via PHP Object Deserialization](https://fearsoff.org/research/roundcube)
- [Vicarius — CVE-2025-49113 Mitigation Script](https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script)
- [GitHub: RoundCube Patch Commit for CVE-2025-49113](https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d)
- [GitHub: RoundCube Pull Request #9865 (Deserialization Fix)](https://github.com/roundcube/roundcubemail/pull/9865)
- [GitHub: RoundCube Patch Commit for CVE-2025-68461 (SVG XSS)](https://github.com/roundcube/roundcubemail/commit/bfa032631c36b900e7444dfa278340b33cbf7cdb)
- [OpenWall oss-security: RoundCube CVE-2025-49113 Disclosure](http://www.openwall.com/lists/oss-security/2025/06/02/3)
- [Debian LTS Announce: RoundCube Security Update](https://lists.debian.org/debian-lts-announce/2025/06/msg00008.html)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [BOD 22-01: Reducing Significant Risk of Known Exploited Vulnerabilities](https://www.cisa.gov/binding-operational-directive-22-01)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0130