CVE-2025-68461: high-severity vulnerability in Roundcube Webmail
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Roundcube Webmail allows attackers to inject malicious scripts through SVG files with animate tags, which can steal user data or take actions on their behalf when viewing emails.
Reflected/stored XSS vulnerability in SVG parsing (animate tag) allows unauthenticated or authenticated attackers to execute arbitrary JavaScript in victim's browser context. Attack vector: malicious SVG attachment or inline SVG in email; impact: session hijacking, credential theft, unauthorized actions.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.