Resolved Roundcube vulnerability CVE-2025-49113

[Sebahat.hadzhi]

Hi, @Laurent_Chouraki . Thank you for the question. Our team is already working on updating Roundcube to 1.6.13 and backporting patches to 1.4. The plan is to introduce the changes along with Plesk Obsidian 18.0.76, which is scheduled for release on the 17th of February.

 

[Laurent_Chouraki]

Thanks Sabahat, it's good to read that !

How bad is the vulnerability in plesk context ?

Regards,
Laurent.

 

[Sebahat.hadzhi]

I am not entirely sure what exactly the impact is. There hasn't been an extensive investigation on it. Rather than that our team focused on delivering the update and the backport patches as quickly as possible.

 

[Kaspar]

@Sebahat.hadzhi will there be a patch/update for 18.0.75 too? Since .76 will be at least two weeks aways from general distribution after it's release.

 

[Sebahat.hadzhi]

Hi, @Kaspar . At his point, there is no plan to backport the changes to version 18.0.75. However, the decision can be reconsidered based on the CVE score and exploitability.

 

[Laurent_Chouraki]

Hi Sebahat, is the release on track ?
Regards,
Laurent.

 

[Sebahat.hadzhi]

Hi, Laurent. Yes, upon an update to version 18.0.76, Roundcube will also be updated to 1.6.13.

 

[Kaspar]

If you like to hold off on upgrading to Plesk 18.0.76 for a while to not get surprised by any yet unknown bugs or product issues, like I do, you can manually patch Roundcube with the attached patch file.

tar -cvf backup-psa-roundcube.tar /usr/share/psa-roundcube/
wget -cO - https://talk.plesk.com/attachments/patch-roundcube-1-6-13-zip.29152/?hash=bc8b34c520188ef5247789512361b506 > patch.roundcube-1.6.13.zip
unzip patch.roundcube-1.6.13.zip
patch -p1 -d /usr/share/psa-roundcube < patch.roundcube-1.6.13

 

[Laurent_Chouraki]

Hi, Laurent. Yes, upon an update to version 18.0.76, Roundcube will also be updated to 1.6.13.

Upgrade OK !
Roundcube 1.6.13 visible in the panel and working well !
Note the ChangeLog for version 18.0.76 doesn't mention the RoundCube update. (https://docs.plesk.com/release-notes/obsidian/change-log/)
Regards,
Laurent.

 

[Sebahat.hadzhi]

Hi, Laurent. Thank you. The change log will be updated.