CVE-2025-68461
RoundCube Webmail Cross-site Scripting Vulnerability
Description
CVE-2025-68461 is a high-severity cross-site scripting (XSS) vulnerability in Roundcube Webmail that allows attackers to execute arbitrary JavaScript in the context of a victim's webmail session. The vulnerability exists in Roundcube versions before 1.5.9 and 1.6.x before 1.6.10 and is triggered when a victim views an email containing crafted SVG content embedded within HTML messages. With a CVSS v3.1 base score of 7.2 and Changed scope (S:C), this vulnerability enables attackers to steal session tokens, read emails, send messages on behalf of the victim, and potentially chain with other vulnerabilities for deeper system compromise. CISA has added CVE-2025-68461 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 13, 2026, confirming active exploitation in the wild. The EPSS score of 9.46% at the 93rd percentile indicates significantly elevated exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| roundcube | webmail | < 1.5.12; >= 1.6.0, < 1.6.12 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
Weakness Type
CWE-79: Cross-site Scripting (XSS)
CVE-2025-68461 is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), the weakness class for cross-site scripting vulnerabilities. This weakness occurs when an application includes untrusted data in web pages without proper validation, escaping, or encoding, allowing attackers to inject client-side scripts that execute in the browser of other users. In Roundcube, the email rendering engine processes HTML email content for display in the browser. While Roundcube includes HTML sanitization to prevent script execution, the vulnerability bypasses these protections through SVG (Scalable Vector Graphics) content. SVG elements can contain event handlers, <script> tags, and other executable content that the sanitizer fails to neutralize, allowing crafted SVG content in email messages to execute JavaScript within the victim's authenticated Roundcube session.
Impact Analysis
The impact of CVE-2025-68461 is significant, particularly due to the Changed scope (S:C) which means the XSS can affect resources beyond the vulnerable Roundcube page. Confidentiality is compromised at a low level (C:L) because the attacker's JavaScript runs within the Roundcube session context and can access session cookies, read displayed emails, enumerate contacts, and extract other information visible to the authenticated user. While the direct data access is limited to what the browser session can reach, the information obtained can enable further attacks.
Integrity faces low-level impact (I:L) as the injected script can perform actions on behalf of the victim, including sending emails, modifying settings, creating filters, or forwarding rules that redirect future emails to attacker-controlled addresses. These actions are performed within the authenticated session and appear legitimate to the server.
Availability is not directly impacted (A:N) by the XSS itself. However, the Changed scope is critical because the XSS payload can interact with other browser tabs, potentially steal credentials from other applications if single sign-on tokens are accessible, or redirect the user to phishing pages. The attack requires no privileges (PR:N) to send the malicious email but does require the victim to open the email (UI:R), which is a natural and expected action for email users.
Exploit Maturity
CVE-2025-68461 is confirmed as actively exploited. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, and its EPSS score of 9.46% at the 93rd percentile indicates that exploitation is well above average. This means only approximately 7% of known vulnerabilities have a higher exploitation probability.
The official Roundcube security update announcement (Roundcube 1.6.10 release) and the related GitHub issue (roundcubemail#9601) provide technical context. XSS vulnerabilities in webmail clients are highly valued by attackers because email is a central communication tool, and session compromise can yield access to sensitive communications, enable social engineering attacks, and provide a foothold for further exploitation. Roundcube XSS vulnerabilities have been historically exploited by state-sponsored threat actors for targeted espionage campaigns, making this vulnerability particularly relevant for organizations handling sensitive communications.
Remediation
Upgrade immediately to Roundcube Webmail version 1.5.9 or later (for the 1.5.x branch) or version 1.6.10 or later (for the 1.6.x branch). The security update released on September 1, 2025, patches the SVG sanitization bypass. The official release announcement at roundcube.net provides upgrade instructions and changelog details.
Content Security Policy (CSP) headers should be configured as an additional defense layer. Implement strict CSP rules that prevent inline script execution and restrict script sources to trusted origins. A well-configured CSP can mitigate the impact of XSS even if the sanitizer is bypassed, by preventing injected scripts from executing or communicating with external servers.
Email content filtering at the mail transfer agent (MTA) or mail gateway level can provide pre-delivery protection. Configure rules to strip or quarantine emails containing SVG elements with embedded script content, event handlers, or other potentially malicious constructs. This approach reduces risk before emails reach the Roundcube interface.
Session security hardening helps limit the damage from successful XSS exploitation. Enable the HttpOnly and Secure flags on session cookies to prevent JavaScript from accessing them. Implement session binding to client IP addresses where feasible, and configure short session timeouts to limit the window of opportunity for session theft. Enable SameSite cookie attributes set to Strict or Lax to prevent cross-site request forgery chaining.
Technical Details
CVE-2025-68461 is an XSS vulnerability exploiting SVG content within HTML emails in Roundcube Webmail. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting a network-accessible attack requiring no attacker privileges but needing the victim to view the malicious email, with changed scope and low impact on confidentiality and integrity.
The vulnerability exists in Roundcube's HTML sanitization engine, which is responsible for cleaning potentially dangerous content from email messages before rendering them in the browser. While the sanitizer correctly handles many common XSS vectors such as <script> tags, javascript: URIs, and HTML event handlers in standard elements, it fails to adequately process SVG elements embedded within HTML emails. SVG content can contain script execution vectors through multiple mechanisms, including <svg:script> elements, SVG-specific event handlers like onload or onbegin, <foreignObject> elements that can embed HTML with scripts, and <use> elements referencing external resources with embedded scripts.
The attacker constructs an HTML email with embedded SVG content that leverages one or more of these SVG-specific script execution techniques. When the Roundcube user opens the email, the browser renders the SVG content within the Roundcube page context, executing the attacker's JavaScript. The script then has access to the DOM of the Roundcube interface, the session cookie (unless protected by HttpOnly), and can make authenticated requests to the Roundcube server on behalf of the victim.
Affected versions include all Roundcube Webmail releases before 1.5.9 and all 1.6.x releases before 1.6.10. The fix enhances the HTML sanitizer to properly process and neutralize script execution vectors within SVG content, including recursive sanitization of SVG child elements and removal of dangerous SVG-specific attributes and elements.
Frequently Asked Questions
What is CVE-2025-68461?
CVE-2025-68461 is a cross-site scripting (XSS) vulnerability in Roundcube Webmail that allows attackers to execute JavaScript in a victim's browser session through crafted SVG content in HTML emails. Viewing the malicious email is sufficient to trigger the attack.
How does the SVG-based XSS attack work?
The attacker sends an HTML email containing embedded SVG elements with hidden script execution vectors. When the victim opens the email in Roundcube, the SVG content bypasses the HTML sanitizer and executes JavaScript in the context of the victim's authenticated webmail session.
Which Roundcube versions are affected by CVE-2025-68461?
All Roundcube Webmail versions before 1.5.9 and all 1.6.x versions before 1.6.10 are affected. The fix is available in versions 1.5.9 and 1.6.10, released on September 1, 2025.
What can an attacker do with this XSS vulnerability?
An attacker can steal session tokens, read emails displayed in the interface, send emails on behalf of the victim, modify account settings, set up email forwarding rules, and potentially use the compromised session as a stepping stone for further attacks.
Is CVE-2025-68461 related to CVE-2025-49113?
Both vulnerabilities affect Roundcube Webmail but are distinct issues. CVE-2025-49113 is a server-side deserialization vulnerability enabling remote code execution (CVSS 9.9), while CVE-2025-68461 is a client-side XSS vulnerability through SVG content (CVSS 7.2). Organizations should patch both by upgrading to the latest Roundcube version.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.