CVE-2025-68461

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG…

High7.2Known exploitedEPSS 27.4%

Published: 18 Dec 2025
Updated: 1 Oct 2026
Reserved: 18 Dec 2025
Assigned by: mitre

Description

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.

Exploited in the wild

CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as RoundCube Webmail Cross-site Scripting Vulnerability.

Added: 20 Feb 2026
Fix due (US federal): 13 Mar 2026
Used by ransomware: Not known

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Scores

CVSS scores of CVE-2025-68461, by who scored it
Scored by	CVSS	Score	Vector
mitreCNA (assigner)	3.1	High7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
NVDNVD · Analyzed	3.1	Medium6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS (exploitation in 30 days): 27.4% · top 1.9% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: active · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

Roundcube · Webmail
- affected < 1.5.12
- affected 1.6.0 – < 1.6.12

References (3)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-68461](https://trackcve.app/badge/CVE-2025-68461.svg)](https://trackcve.app/cve/CVE-2025-68461)

Record last updated 1 Oct 2026, 18:12 UTC.