CVE-2025-49113

LLM-synthesized narrative grounded in this CVE's description and references.

Versions sourced from the GitHub Security Advisory.

• Roundcube/Webmail2 versions

  cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*+ 1 more

  • cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*range: <1.5.10
  • (no CPE)range: 0
• Debian/linux

  cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
• ghsa-coords

  pkg:composer/roundcube/roundcubemail

  Range: < 1.5.10

• github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4dnvdPatchWEB
• github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695nvdPatchWEB
• github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637envdPatchWEB
• www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-scriptnvdExploitMitigationThird Party AdvisoryWEB
• www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detectionnvdExploitMitigationThird Party AdvisoryWEB
• www.openwall.com/lists/oss-security/2025/06/02/3nvdMailing ListThird Party AdvisoryWEB
• fearsoff.org/research/roundcubenvdThird Party AdvisoryWEB
• github.com/advisories/GHSA-8j8w-wwqc-x596ghsaADVISORY
• lists.debian.org/debian-lts-announce/2025/06/msg00008.htmlnvdMailing ListThird Party AdvisoryWEB
• nvd.nist.gov/vuln/detail/CVE-2025-49113ghsaADVISORY
• roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10nvdVendor AdvisoryWEB
• github.com/roundcube/roundcubemail/pull/9865nvdIssue TrackingWEB
• github.com/roundcube/roundcubemail/releases/tag/1.5.10nvdRelease NotesWEB
• github.com/roundcube/roundcubemail/releases/tag/1.6.11nvdRelease NotesWEB
• www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government ResourceWEB

• Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
  The Hacker News · Aug 12, 2026
• Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day
  Infosecurity Magazine · Aug 12, 2026
• Lazarus hackers pair fake job offers with Windows zero-day exploit
  Help Net Security · Aug 12, 2026
• Fresh Windows Zero-Day Exploited in North Korean Cyberattacks
  SecurityWeek · Aug 12, 2026
• Windows AFD.sys 0-Day Actively Exploited by Lazarus Hackers to Deploy FudModule Rootkit
  Cyber Security News · Aug 12, 2026
• Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack
  Check Point Research · Aug 11, 2026
• Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks
  The Hacker News · Jul 24, 2026
• Suspected Chinese snoops caught breaking into universities' Roundcube mailservers
  The Register Security · Jul 8, 2026
• Hackers exploit Roundcube flaw to spy on academic researchers
  BleepingComputer · Jul 8, 2026
• Hackers Exploit Roundcube N-Day Flaws to Steal Credentials and Deploy VShell
  Cyber Security News · Jul 8, 2026
• Chinese Cyberespionage Exploits University Roundcube Servers
  GovInfoSecurity · Jul 7, 2026
• Suspected Chinese Threat Group Targets Universities via Vulnerable Roundcube Servers
  Infosecurity Magazine · Jul 7, 2026
• Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities
  The Hacker News · Jul 7, 2026
• Suspected Chinese espionage group used a Roundcube exploit chain to burrow into universities
  CyberScoop · Jul 7, 2026
• Russian Threat Groups Use RDP, VPN, Supply Chain Attacks, and Social Engineering for Initial Access
  Cyber Security News · May 22, 2026