CyberQuestor-infosec/CVE-2025-49113-Roundcube_1.6.10

GitHubRepository PoCWriteup

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README.md writeup describing CVE-2025-49113, an authenticated RCE vulnerability in Roundcube 1.6.10. It provides a technical overview, lab setup instructions, and command-line usage for an external exploit script, but does not include the exploit code itself.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists solely of a README.md file describing a known CVE, lab setup, and usage instructions for a public exploit. No executable code, concealed payloads, or deceptive behavior targeting the reviewer is present in the reviewed text.

ClassificationWriteup
Model confidence95%
AuthenticationRequired
LanguagesMarkdown
Target softwareRoundcube Webmail
Attack typesRemote Code ExecutionDeserialization of Untrusted Data
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file that provides a technical analysis, description, and usage instructions for an exploit, but does not contain any executable exploit or scanner code. It is a substantive technical writeup.

README.md:1-98

Requirements

  • Valid user credentials for the target Roundcube instance.README.md:18
  • Target running Roundcube version 1.6.10.README.md:23

Observed behavior

  • The writeup instructs the user to run an external PHP exploit script (CVE-2025-49113.php) with a target URL, credentials, and a reverse shell command.README.md:49-50
  • The writeup references a public GitHub repository for the exploit code, indicating the exploit is not contained within this artifact.README.md:26
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

External Reference
https://github.com/hakaioffsec/CVE-2025-49113-exploitREADME links to an external public exploit repository; the content of that repository is not included in the evidence and was not reviewed.README.md:26
External Reference
https://medium.com/@cyberquestor/cve-2025-49113-roundcube-1-6-10-remote-code-execution-0598e7944361?sk=b0023c78b7f0d8de5e683f4d2316967dREADME links to an external Medium blog post; the content of that post is not included in the evidence and was not reviewed.README.md:98
Review boundaries

What the analysis did not establish

  • The artifact's analysis_routing classification is NO_POC_CODE_IDENTIFIED, and the inventory reports no executable source identified, confirming the absence of exploit or scanner code.
  • The evidence packet contains only the README.md file; two other non-text files (images) are present but not included, so their content cannot be analyzed.
  • The writeup references an external exploit script (CVE-2025-49113.php) and a public GitHub repository, but these are not part of the supplied evidence.
  • Two non-text media files (likely screenshots) were present in the repository but were not analyzed; their content could theoretically contain hidden instructions, though this is unlikely given the context.
  • The external exploit repository and Medium blog post referenced in the README were not included in the evidence and were not reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1