← All advisories

High severity7.2CISA KEVOSV Advisory· Published Dec 18, 2025· Updated Jun 17, 2026

CVE-2025-68461

CVE-2025-68461

Description

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4

Roundcube/RoundcubemailOSV2 versions
1.1-beta, 1.1-rc, 1.1.0, …+ 1 more
- (no CPE)range: 1.1-beta, 1.1-rc, 1.1.0, …
- (no CPE)range: <1.5.12, <1.6.12
Roundcube/Webmail
cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
Range: <1.5.12
osv-coords
pkg:rpm/opensuse/roundcubemail&distro=openSUSE%20Leap%2016.0
Range: < 1.6.13-bp160.1.1

Patches

Vulnerability mechanics

References

3

github.com/roundcube/roundcubemail/commit/bfa032631c36b900e7444dfa278340b33cbf7cdbnvdPatch
roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12nvdVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

News mentions

0

No linked articles in our index yet.