CVE-2025-68461: Roundcube Webmail cross-site scripting via SVG animate tag, in KEV
The short version: Roundcube Webmail has a cross-site scripting flaw (CVE-2025-68461) that abuses the animate tag inside an SVG document to run attacker script when a crafted email is viewed. It follows the same pattern as Roundcube's earlier SVG XSS bugs, and it's in CISA's KEV catalog. The fix is a straightforward upgrade. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — see below |
| CVSS v3.1 (NVD) | 6.1 — Medium · AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CVSS (MITRE, CNA) | 7.2 — High · AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
| EPSS | 20.09% · 97.16th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2026-03-13 |
| Known exploited? | Yes — listed as a known-exploited XSS |
| Vulnerability type | CWE-79 cross-site scripting (SVG animate tag) → session/credential theft |
| Requires authenticated session? | No for the attacker — a logged-in victim must view the crafted message |
| Affected | Roundcube Webmail before 1.5.12 and 1.6.x before 1.6.12 |
| Fixed in | 1.5.12 · 1.6.12 |
What you need to know
Like the SVG-based XSS bugs before it, this flaw lets a crafted SVG animate element carry JavaScript past Roundcube's sanitizer, so viewing the message executes attacker code in the user's session.
- Delivery is email. No prior access to your environment is required.
- The payoff is the session. Script inside webmail can read the mailbox view and stage a fake login to capture credentials.
- It's a repeat pattern. Roundcube has patched several SVG-attribute XSS issues; attackers know the class well, which is why this one reached KEV quickly.
How serious we see it
High — with the usual honest framing.
NVD scores 6.1; the CNA's 7.2 differs mainly on whether user interaction is required. Either way this is session-scoped XSS, not code execution — but it's KEV-listed because webmail XSS is a dependable route to credential theft. It stays Moderate in our book: real, but bounded, and closed by a published patch you can confirm quickly.
Recommendations
Straight from Roundcube's advisory and CISA:
- Patch now. Upgrade to 1.6.12 or 1.5.12 (or later).
- Enforce MFA on webmail to reduce the value of a stolen password.
- Restrict exposure. Keep the Roundcube host reachable only where it must be.
- Warn users about in-app re-login prompts — a native-looking password prompt inside webmail is worth a report.
- Confirm your exposure first. Verify whether an internet-facing Roundcube instance exists and which version.
How BreachRisk sees it
BreachRisk discovers internet-facing Roundcube from little more than your domain, fingerprints the version, and flags exposure tied to KEV-listed vulnerabilities like this one, ranked up because it's actively exploited. We identify and flag the affected version; we don't deliver the payload. The outside-in view keeps an exposed, unpatched Roundcube on your map before an attacker's email finds it.