CVE-2025-68461

What it actually does

Roundcube Webmail versions before 1.5.12 and 1.6.x before 1.6.12 fail to safely sanitize SVG content containing the SVG animate tag. A crafted SVG document can cause attacker-controlled JavaScript or HTML to execute in the victim’s browser in the security context of the Roundcube webmail application. Because the script runs as the logged-in user, it may read webmail content visible to that user, perform actions through the Roundcube session, alter user settings such as forwarding rules or signatures, and potentially steal session-related data depending on cookie flags and browser protections. The flaw is remotely reachable through webmail content and is listed in CISA KEV, indicating confirmed exploitation in the wild.

Why it matters to the business

Successful exploitation can compromise mailbox confidentiality and integrity without requiring server-level code execution. Attackers may use the vulnerability to read sensitive email, harvest credentials or reset links, create persistence through mail rules, impersonate users, and pivot into other systems that trust email-based workflows. Because Roundcube is commonly internet-facing and this issue is in the Known Exploited Vulnerabilities catalog with a remediation deadline of 2026-03-13, exposed deployments should be treated as high-priority even though the CVSS score is 7.2. The EPSS score of 0.20506 and active exploitation status indicate a meaningful likelihood of opportunistic scanning or targeted abuse.

How an attack unfolds

An attacker prepares an email or uploaded webmail-accessible object containing a malicious SVG that abuses the animate tag to bypass Roundcube’s HTML/SVG sanitization. The payload is delivered to a Roundcube user, commonly as an HTML email, embedded image, attachment, or other rendered message content. When Roundcube processes or displays the crafted content, the malicious SVG executes script in the browser under the Roundcube origin. The attacker-controlled script can then issue authenticated requests as the victim, read messages rendered in the interface, scrape contact data, change preferences, create forwarding/filter rules, or exfiltrate accessible data to an external endpoint. In campaigns against webmail platforms, this type of XSS is often used for mailbox espionage, credential theft, and durable access through mail forwarding rather than noisy malware execution on the server.

How to fix it

Upgrade Roundcube immediately to a fixed release: Roundcube 1.5.12 or later for the 1.5 branch, or Roundcube 1.6.12 or later for the 1.6 branch. For source-based deployments, ensure the deployed code includes Roundcube commit bfa032631c36b900e7444dfa278340b33cbf7cdb or a later vendor release containing the fix. Where Ubuntu 16.04 php7.0 packages are still in use, update php7.0 to 7.0.18-0ubuntu0.16.04.1 or later; however, Ubuntu 16.04 is end-of-life for most environments and should be migrated to a supported OS and PHP runtime. If immediate upgrade is not possible, reduce exposure by restricting Roundcube access to trusted networks or VPN, disabling rendering of unsafe HTML where operationally feasible, blocking or stripping SVG attachments/content at the mail gateway, enforcing strong Content Security Policy controls, and monitoring for suspicious forwarding/filter rule changes. Mitigations should be considered temporary because the vulnerability is known exploited.

How to confirm the fix worked

Confirm the installed Roundcube version from the web UI, package manager, application files, or source control and verify it is 1.5.12 or later, 1.6.12 or later, or contains commit bfa032631c36b900e7444dfa278340b33cbf7cdb. Validate that internet-facing instances no longer report vulnerable versions through authenticated administrative checks, asset inventory, or approved vulnerability scanning. Review webmail behavior with a benign SVG animate-tag test payload in a non-production or controlled environment to ensure active content is neutralized rather than executed. Confirm package updates for any Ubuntu php7.0 dependency where applicable. After patching, clear application caches, restart web/PHP services, and verify no user mail filters, forwarding rules, identities, signatures, or preferences were modified unexpectedly before or during the vulnerable window.

Typical attack path

1. Identify an organization exposing Roundcube Webmail or target known Roundcube users through email reconnaissance.
2. Craft an SVG document or HTML email containing an SVG animate-tag payload designed to survive Roundcube sanitization.
3. Send the crafted message to a target mailbox or otherwise place the content where Roundcube will render it.
4. Wait for the victim’s Roundcube session to display or preview the malicious content.
5. Execute JavaScript in the victim’s browser under the Roundcube application origin.
6. Use the victim’s authenticated session to read mail, collect contacts, alter preferences, create mail forwarding/filter rules, or exfiltrate data.
7. Maintain access through mailbox rules, stolen credentials, or repeated delivery of crafted messages.

How to detect it

Investigate whether exploitation already occurred by correlating mail gateway logs, mailbox contents, Roundcube logs, web server access logs, reverse-proxy logs, endpoint/browser telemetry, DNS logs, and outbound proxy logs. Search inbound and stored messages for SVG content using animate tags, event-handler attributes, JavaScript URIs, base64-encoded SVG payloads, or unusual external URLs embedded in email bodies or attachments. Review Roundcube logs commonly located under /var/log/roundcube/ and web server logs such as /var/log/apache2/access.log, /var/log/apache2/error.log, /var/log/nginx/access.log, and /var/log/nginx/error.log for message views, attachment access, preference changes, and suspicious POST requests around the time malicious messages were received or opened. Examine Roundcube user-level artifacts for unexpected identities, signatures, filters, address book changes, and forwarding rules. Check mail server logs for new outbound forwarding behavior or unusual IMAP activity after suspected rendering. In proxy, DNS, and EDR telemetry, look for browser connections from webmail user workstations to unfamiliar external domains immediately after Roundcube pages loaded. Because XSS execution may leave limited server-side evidence, give high weight to malicious email artifacts plus suspicious authenticated Roundcube actions and outbound browser network activity in close time proximity.

• <animate
• <svg
• </animate>
• xlink:href
• javascript:
• data:image/svg+xml
• image/svg+xml
• onbegin=
• onend=
• onrepeat=
• attributeName="href"
• attributeName='href'
• attributeName="xlink:href"
• attributeName='xlink:href'
• values="javascript:
• values='javascript:
• from="javascript:
• to="javascript:
• /var/log/roundcube/errors.log
• /var/log/roundcube/sendmail.log
• /var/log/apache2/access.log
• /var/log/apache2/error.log
• /var/log/nginx/access.log
• /var/log/nginx/error.log
• bfa032631c36b900e7444dfa278340b33cbf7cdb

What your security team should do

• Patch all Roundcube deployments to 1.5.12, 1.6.12, or later immediately; prioritize internet-facing systems and systems used by executives, administrators, help desks, or finance staff.
• Treat this as an actively exploited vulnerability because it is in CISA KEV; complete remediation ahead of the 2026-03-13 deadline rather than waiting for routine maintenance.
• Search mail stores, quarantine systems, and security email gateways for messages or attachments containing SVG animate-tag constructs, especially those combined with script-like attributes or external exfiltration URLs.
• Review Roundcube user preferences, identities, signatures, filters, and forwarding rules for unauthorized changes, especially recently created external forwarding destinations.
• Inspect web server, Roundcube, mail gateway, proxy, and EDR/browser telemetry for suspicious external connections following webmail message rendering.
• Temporarily block or sanitize inbound SVG content at the mail gateway if patching cannot be completed immediately.
• Restrict Roundcube access with VPN, SSO/MFA, IP allowlisting, or reverse-proxy controls where possible.
• Rotate credentials and revoke active sessions for accounts with evidence of malicious message rendering, suspicious rule changes, or mailbox access anomalies.
• Harden webmail with Content Security Policy, HttpOnly/Secure/SameSite cookies, and attachment rendering restrictions to reduce impact of future XSS issues.
• Create SOC detections for SVG animate payloads in email content and for anomalous Roundcube preference changes or outbound requests to newly observed domains.