Description
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Roundcube | Webmail | < 1.5.12, 1.6.0 – < 1.6.12 | 1.5.12 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | roundcube | 1.6.12+dfsg-1 | — |
| Debian 13 | roundcube | 1.6.12+dfsg-0+deb13u1 | DSA-6087-1 |
| Debian 12 | roundcube | 1.6.5+dfsg-1+deb12u6 | DSA-6087-1 |
| Debian 11 | roundcube | 1.4.15+dfsg.1-1+deb11u6 | DLA-4415-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | roundcube | No fix yet | — |
| Ubuntu 25.10 | roundcube | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | roundcube | 1.6.11+dfsg-1ubuntu0.26.04.1~esm1 | USN-8482-1 |
| Ubuntu Pro 24.04 LTS | roundcube | 1.6.6+dfsg-2ubuntu0.1+esm2 | USN-8097-1 |
| Ubuntu Pro 22.04 LTS | roundcube | 1.5.0+dfsg.1-2ubuntu0.1~esm5 | USN-8097-1 |
| Ubuntu Pro 20.04 LTS | roundcube | 1.4.3+dfsg.1-1ubuntu0.1~esm7 | USN-8097-1 |
| Ubuntu Pro 18.04 LTS | roundcube | 1.3.6+dfsg.1-1ubuntu0.1~esm6 | USN-8097-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | roundcubemail | 1.6.13-bp160.1.1 | openSUSE-SU-2026:20323-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
rxerium/CVE-2025-68461 ★ 16 · Dec 19, 2025
Detection for CVE-2025-68461
-
gotr00t0day/CVE-2025-68461 ★ 6 · Dec 22, 2025
A C++ security scanner tool to detect Cross-Site Scripting (XSS) vulnerabilities in Roundcube Webmail installations.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 7
- USN-8482-1 roundcube vulnerability Ubuntu Security Notices (USN) · Jun 30, 2026
- WID-SEC-2025-2854 Roundcube: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 29, 2026
- USN-8097-1 roundcube vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2026:20323-1 Security update for roundcubemail SUSE / openSUSE Security Updates · Mar 23, 2026
- NCSC-2025-0405 Kwetsbaarheid verholpen in Roundcube Webmail NCSC-NL (Netherlands) · Dec 31, 2025
- DSA-6087-1 roundcube - security update Debian Security (DSA / DLA) · Dec 19, 2025
- DLA-4415-1 roundcube - security update Debian Security (DSA / DLA) · Dec 18, 2025