Summary
It was discovered that Roundcube Webmail was prone to a Cross-Site-Scripting
(XSS) vulnerability via the animate tag in an SVG document. An attacker
could use this issue to execute arbitrary web script in the context of an
affected user's session.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | roundcube | 1.6.11+dfsg-1ubuntu0.26.04.1~esm1 |
Vulnerabilities 1
-
High 7.2
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the an…
KEV Feb 20, 2026
References
-
report
https://ubuntu.com/security/CVE-2025-68461