PT-2025-51990 · Roundcube+2 · Roundcube Webmail+2

Valentin T · Published 2025-12-13 · Updated 2026-04-01 · CVE-2025-68460

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Roundcube versions prior to 1.5.12 Roundcube versions prior to 1.6.12

Description An information disclosure issue exists in the HTML style sanitizer component of Roundcube Webmail. The issue could allow for the disclosure of information.

Recommendations Update Roundcube to version 1.5.12 or later. Update Roundcube to version 1.6.12 or later.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

BDU:2025-16316

CVE-2025-68460

DLA-4415-1

DSA-6087-1

MGASA-2025-0332

OPENSUSE-SU-2026:20323-1

Affected Products

Debian

Red Os

Roundcube Webmail

References · 39

• https://github.com/roundcube/roundcubemail/commit/08de250fba731b634bed188bbe18d2f6ef3c7571 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-68460 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0332 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20323-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4415-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-68460 · Security Note
• https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-68460 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-68460 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68460 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68460 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16316 · Security Note
• https://advisories.mageia.org/MGASA-2025-0332.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-68460 · Security Note
• https://osv.dev/vulnerability/DSA-6087-1 · Vendor Advisory