Roundcube Webmail is susceptible to critical remote code execution through deserialization of untrusted data, and this vulnerability is currently being exploited in the wild.

The application fails to validate the _from parameter within the upload.php file, which allows authenticated users to trigger a PHP object deserialization flaw. This mechanism enables an attacker to achieve remote code execution on the underlying server.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the web application, resulting in a total compromise of the mail server. Given the CVSS score of 9.5, this flaw poses a severe risk to confidentiality, integrity, and availability. Organizations using Roundcube should expect potential data theft, lateral movement, or complete system takeover if not remediated immediately.

Immediate Action: Upgrade to Roundcube Webmail version 1.5.10 or 1.6.11 immediately to address the insecure deserialization flaw.

Proactive Monitoring: Monitor server logs for suspicious requests targeting upload.php or unusual process execution patterns originating from the web server user.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and sanitize serialized PHP objects in URL parameters, though such measures are temporary and do not replace the necessity of patching.

Public Exploit Available: Yes, a weaponized exploit is available via Metasploit and ExploitDB.

The severity of this vulnerability, combined with its active exploitation and weaponized status, necessitates an immediate emergency patch cycle. All instances of Roundcube Webmail must be updated to the provided fixed versions without delay to prevent unauthorized system access and potential data breaches.