CVE-2025-68461: Roundcube Webmail XSS via SVG animate tag

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is a network-reachable XSS in a widely deployed webmail client and is listed in CISA KEV as known exploited, though it requires user interaction and has medium CVSS severity.

What it is

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is vulnerable to cross-site scripting through the animate tag in an SVG document. Because the flaw is reachable in a webmail client that renders untrusted message content, it can be used to run script in the context of a victim's session.

Impact

An attacker can execute script in the victim's webmail origin, which can lead to session or credential theft and actions performed as the victim. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reached over the network with no privileges required, but user interaction is required (CVSS UI:R), consistent with a victim opening or viewing a crafted SVG-bearing message. No authentication is needed to deliver the payload, though the victim must be logged into Roundcube for the script to run in their session.

Exploitation

CVE-2025-68461 is listed in CISA KEV with a due date of 2026-03-13, indicating known exploitation; EPSS is 0.26842 (97.9th percentile). No ransomware campaign use is documented.

What to do

• Upgrade Roundcube Webmail to 1.5.12 or 1.6.12 (or later) using the vendor patch commit.
• If immediate patching is not possible, apply the vendor's recommended mitigations or restrict access to the webmail interface.
• Follow BOD 22-01 guidance for cloud-hosted instances, including discontinuing use if mitigations are unavailable.
• Sanitize or block SVG content in inbound mail and enforce a strict Content-Security-Policy on the webmail origin.
• Review webmail session and authentication logs for signs of compromise after exposure.

Detection

• Hunt for inbound messages containing SVG documents with animate elements, especially in HTML or attachment parts.
• Monitor webmail access logs for requests referencing SVG content or unexpected script execution patterns.
• Alert on anomalous session activity or credential use from webmail accounts following message viewing.
• Check for the vendor patch level on all Roundcube instances and flag unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.