CVE.RADIO
FREN

CVE-2025-49113

roundcubemailVulnerabilityCVSS 9.9PatchedPoC

A public proof-of-concept or exploit code is available, raising the risk of active exploitation. A fixed version is available (see the table below).

Recommended action: Update to the fixed version listed for your distribution using the native package manager.

Severity metrics

CVSS 3.1 : 9.9 CRITICAL

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeChanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh

Vector: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected & fixed versions by distribution

Versions are the native distribution strings (backport-aware): RHEL/Debian/SUSE backport fixes, so compare with the distro version comparator (dpkg / rpm / vercmp), not the upstream version.

DistributionPackageAffectedFixed versionStatus
Archroundcubemail1.6.10-11.6.11-1fixed
Debian:11roundcube-1.4.15+dfsg.1-1+deb11u5fixed
Debian:12roundcube-1.6.5+dfsg-1+deb12u5fixed
Debian:13roundcube-1.6.11+dfsg-1fixed
Debian:14roundcube-1.6.11+dfsg-1fixed
Ubuntu:Pro:16.04:LTSroundcube-1.2~beta+dfsg.1-0ubuntu1+esm6fixed
Ubuntu:Pro:18.04:LTSroundcube-1.3.6+dfsg.1-1ubuntu0.1~esm5fixed
Ubuntu:Pro:20.04:LTSroundcube-1.4.3+dfsg.1-1ubuntu0.1~esm5fixed
Ubuntu:Pro:22.04:LTSroundcube-1.5.0+dfsg.1-2ubuntu0.1~esm4fixed
Ubuntu:24.04:LTSroundcube-1.6.6+dfsg-2ubuntu0.1fixed

Sources