CVE-2025-68461

Name of the Vulnerable Software and Affected Versions Roundcube versions prior to 1.5.12 Roundcube versions prior to 1.6.12

Description Roundcube Webmail contains a Cross-Site Scripting (XSS) issue stemming from the use of the animate tag within SVG documents. This allows attackers to execute malicious scripts. Additionally, an Information Disclosure issue exists in the HTML style sanitizer. The issue is actively exploited and could lead to email account takeover. There is no information available regarding the number of affected devices.

Recommendations Roundcube versions prior to 1.5.12 should be updated to version 1.5.12 or later. Roundcube versions prior to 1.6.12 should be updated to version 1.6.12 or later.