Point hosts at Roundcube and flag CVE-2025-49113 by version. No confirm: the _from gadget needs a login and deserializes PHP. Version flag only. CISA KEV.
Target List — Hosts, IPs, or URLs, one per line. Empty input uses localhost.
Overview
This workflow finds Roundcube Webmail and sorts each host by whether its version falls in the CVE-2025-49113 range. CVE-2025-49113 is authenticated PHP object injection via _from. Confirm would log in and deserialize. This graph only reads the public login page. CISA listed it on KEV after confirmed use. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints the product from the public login page, reads the version, and compares that number to the range table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. There is no confirm node. The _from gadget needs a login and deserializes PHP. Version flag only.
Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
Fingerprint each host as Roundcube from the public login page, then read the version and compare it to the CVE-2025-49113 floors in the graph.
Collect the per-host rows: product match, version, affected flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, affected, and errors.
Inputs
Target list. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. JSONL with a url field also works. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether Roundcube was detected, the version read, and the affected flag.
summary.json. Counts across the list: targets, product hits, affected, and errors.
Integrations
HTTP. Unauthenticated GET to the public login page. No login and no _from gadget.
Sample output
The records below are illustrative and do not come from a real run. They show one Roundcube host inside the CVE-2025-49113 range, one patched host, and one host that is not the product.
1.6.x before 1.6.11, 1.5.x before 1.5.10, and older 1.x lines. 1.6.11 and 1.5.10 are the floors. The compare uses the version the product itself served.
Why is there no confirm step?
CVE-2025-49113 is authenticated PHP object injection. Confirm would log in and deserialize. There is no non-intrusive probe. The DAG stays targets, check, collect, summary.
Does a flagged host mean CVE-2025-49113 was exploited?
No. A flagged row is patch-lag against the range table. The run does not log in and does not send _from. Treat it as a patching signal.
Is this check safe on production?
Yes. It only sends read-only GET requests to the login page. It does not log in and it does not deserialize PHP.
Does the check need credentials?
No. It fingerprints the public login page the way an external scanner would.