High 1 exploited CVE USN-8097-1 1 CVE

roundcube vulnerabilities

Published Mar 16, 2026 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Roundcube Webmail did not properly sanitize the
animate tag within SVG documents. An attacker could possibly use
this issue to cause a cross-site scripting attack.

Fixed packages 4

Release	Package	Fixed in
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS	roundcube	1.3.6+dfsg.1-1ubuntu0.1~esm6
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS	roundcube	1.4.3+dfsg.1-1ubuntu0.1~esm6
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS	roundcube	1.5.0+dfsg.1-2ubuntu0.1~esm5
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS	roundcube	1.6.6+dfsg-2ubuntu0.1+esm2

Vulnerabilities 1

High 7.2

CVE-2025-68461 Exploited Public exploit EPSS 27%

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the an…

Roundcube Webmail roundcube roundcube Debian Ubuntu

Dec 18, 2025
KEV Feb 20, 2026

References

report
https://ubuntu.com/security/CVE-2025-68461