Cross-Site Scripting Vulnerability in Roundcube Webmail from Roundcube
CVE-2025-68461

7.2HIGH

Key Information:

Vendor

Roundcube

Status
Webmail
Vendor
CVE Published:
18 December 2025

Badges

📈 Trended📈 Score: 1,530👾 Exploit Exists🦅 CISA Reported📰 News Worthy

What is CVE-2025-68461?

CVE-2025-68461 is a Cross-Site Scripting (XSS) vulnerability identified in Roundcube Webmail, which is an open-source webmail application used widely for email management. This vulnerability affects versions prior to 1.5.12 and 1.6 prior to 1.6.12, enabling an attacker to execute malicious scripts in the context of a user's session. The exploit leverages the animate tag within an SVG document, which can lead to unauthorized actions taken on behalf of the user, potentially compromising sensitive information and undermining the overall security of the webmail system. Organizations relying on Roundcube for their email communication may face significant repercussions, such as data breaches or potential unauthorized access to user accounts.

Potential impact of CVE-2025-68461

  1. Data Compromise: Attackers exploiting this vulnerability can execute arbitrary scripts, which may lead to the theft of sensitive information, such as login credentials and personal data.

  2. User Session Hijacking: By executing scripts in the context of a user session, adversaries could impersonate users, allowing them to perform unauthorized actions, thereby jeopardizing user trust and system integrity.

  3. Propagation of Malware: The XSS vulnerability can be used to deliver malicious payloads to users, potentially resulting in the spread of malware or more sophisticated attacks across the network.

CISA has reported CVE-2025-68461

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2025-68461 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Webmail 0 < 1.5.12

Webmail 1.6.0 < 1.6.12

News Articles

favicon imageBleepingComputer

CISA: Recently patched RoundCube flaws now exploited in attacks

CISA flagged two Roundcube Webmail vulnerabilities as actively exploited in attacks and ordered U.S. federal agencies to patch them within three weeks.

1 week ago

References

https://roundcube.net/news/2025/12/13/security-updates-1....
https://github.com/roundcube/roundcubemail/commit/bfa0326...

EPSS Score

6% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 📰

    First article discovered by BleepingComputer

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • 📈

    Vulnerability started trending

  • Vulnerability published

  • Vulnerability Reserved

JSON
.