CVE-2025-68460
High · 7.2CVSS
7.2
EPSS
0.3%
Published
Dec 18, 2025
CISA due date
—
The record
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:9 | roundcubemail | 0 | 1.6.12-1.mga9 |
| openSUSE:Leap 16.0 | roundcubemail | 0 | 1.6.13-bp160.1.1 |
Related vulnerabilities
- CVE-2025-68461 Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting… Also affects roundcubemail
- CVE-2025-49113 Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by… Also affects roundcubemail
- CVE-2024-42010 mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters… Also affects roundcubemail
- CVE-2026-35537 An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Also affects roundcubemail
- CVE-2026-26079 Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS)… Also affects roundcubemail
- CVE-2026-25916 Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is… Also affects roundcubemail