Resolved Roundcube vulnerability CVE-2025-49113

[Sebahat.hadzhi]

Hi, @Laurent_Chouraki . Thank you for the question. Our team is already working on updating Roundcube to 1.6.13 and backporting patches to 1.4. The plan is to introduce the changes along with Plesk Obsidian 18.0.76, which is scheduled for release on the 17th of February.

 

[Laurent_Chouraki]

Thanks Sabahat, it's good to read that !

How bad is the vulnerability in plesk context ?

Regards,
Laurent.

 

[Sebahat.hadzhi]

I am not entirely sure what exactly the impact is. There hasn't been an extensive investigation on it. Rather than that our team focused on delivering the update and the backport patches as quickly as possible.

 

[Kaspar]

@Sebahat.hadzhi will there be a patch/update for 18.0.75 too? Since .76 will be at least two weeks aways from general distribution after it's release.

 

[Sebahat.hadzhi]

Hi, @Kaspar . At his point, there is no plan to backport the changes to version 18.0.75. However, the decision can be reconsidered based on the CVE score and exploitability.