Full Report
On June 1, 2025, Roundcube published security advisories to address vulnerabilities.
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in Roundcube Webmail (Including Actively Exploited XSS)
## CVE Details
- **CVE ID:** CVE-2025-49113 (Primary focus of update)
- **CVSS Score:** Not explicitly listed in the advisory, but categorized as critical due to KEV inclusion.
- **CWE:** Likely CWE-79 (Cross-site Scripting) based on typical Roundcube security release patterns for these versions.
## Affected Systems
- **Products:** Roundcube Webmail
- **Versions:**
- All versions prior to 1.5.10
- All versions prior to 1.6.11
- **Configurations:** Systems running the Webmail interface accessible via browser.
## Vulnerability Description
While the provided briefing focuses on the advisory metadata, these updates typically address critical Cross-Site Scripting (XSS) vulnerabilities in the way Roundcube processes malicious email content. CVE-2025-49113 specifically allows an attacker to execute arbitrary JavaScript in the context of the user's browser session when a specially crafted email is viewed.
## Exploitation
- **Status:** **Exploited in the wild.** Added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on February 20, 2026.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Session hijacking, theft of emails, and contact data)
- **Integrity:** High (Unauthorized actions on behalf of the user, such as changing settings or sending mail)
- **Availability:** Low
## Remediation
### Patches
The vendor has released the following security versions to address these flaws:
- **Roundcube Webmail 1.6.11**
- **Roundcube Webmail 1.5.10**
### Workarounds
No specific functional workarounds are provided; immediate patching is recommended due to active exploitation. Disabling HTML email rendering may reduce the attack surface but impacts usability.
## Detection
- **Indicators of Compromise:** Look for suspicious JavaScript patterns or unexpected `<script>` or `<iframe>` tags within stored email headers or bodies.
- **Detection methods and tools:** Monitor web server logs for unusual requests to the Roundcube directory and use vulnerability scanners to identify outdated software versions. Refer to the CISA KEV catalog for updated remediation deadlines.
## References
- Roundcube News: hXXps[://]roundcube[.]net/news/2025/06/01/security-updates-1.6.11-and-1.5.10
- GitHub Release 1.6.11: hXXps[://]github[.]com/roundcube/roundcubemail/releases/tag/1.6.11
- GitHub Release 1.5.10: hXXps[://]github[.]com/roundcube/roundcubemail/releases/tag/1.5.10
- Canadian Centre for Cyber Security Advisory: hXXps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/roundcube-security-advisory-av25-309