CVE-2025-68461 is a cross-site scripting vulnerability in Roundcube Webmail. CISA added it to the Known Exploited Vulnerabilities catalogue on 20 February 2026, which means attackers have used it in real attacks. RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.
How CVE-2025-68461 Works in Roundcube Webmail
CVE-2025-68461 is a cross-site scripting issue in Roundcube Webmail, where attacker-controlled content in an SVG document can execute in the browser. That matters because webmail is a high-trust interface: when script runs there, it can act on behalf of the user inside an authenticated session.
The specific weakness is the unsafe handling of the SVG animate tag. SVG content often passes through richer rendering and sanitisation paths than plain HTML, so a filter that misses a browser-executable element can leave a script execution path open even when the page otherwise looks like ordinary mail content.
Why This Vulnerability Is Dangerous
XSS in webmail is dangerous because the attacker does not need to break the mailbox platform itself to gain leverage. If a user opens a crafted message or attachment preview, injected script can read page content, trigger actions in the mailbox UI, or steal browser-held session material that the application relies on for trust.
For a product like Roundcube, the impact is often broader than a single malformed message. Webmail is used for password resets, approvals, internal correspondence, and access to other systems, so script execution can become a stepping stone to account abuse, message theft, and follow-on phishing from a legitimate mailbox.
How Organisations Check Exposure and Reduce Blast Radius
Start with asset inventory and version ownership. Organisations need to know where Roundcube is deployed, which internet-facing instances are reachable, and whether any hosted mail service, appliance, or packaged distribution includes the vulnerable component. Vendor advisories and the CISA Known Exploited Vulnerabilities catalogue are the authoritative places to confirm prioritisation and patch guidance.
Until patching is complete, compensating controls should reduce script execution opportunities and user exposure. That typically means tightening message and attachment handling, restricting HTML and SVG rendering paths where practical, and making sure mail users are not exposed through unnecessary public-facing interfaces. The broader vulnerability-management process described in the Vulnerability Management Guide is the right operational frame for prioritising internet-exposed, actively exploited flaws.
Detection, Response, and Post-Exploitation Review
Detection should look for signs that a webmail session behaved like a browser exploit rather than normal user activity. Unusual outbound requests from the browser context, unexpected mailbox actions, or suspicious message body patterns containing executable SVG content are all worth reviewing. After patching, organisations should not assume the issue ended with remediation.
Post-patch review should confirm whether any mailbox content, sessions, or downstream accounts were touched during exploitation. If the webmail account was used for privileged workflows, password resets, or delegated approvals, those paths should be reviewed for tampering. Where exploitation is suspected, the investigation should also consider whether the attacker used the compromised mailbox to send follow-on phishing or to persist through trusted conversations.
Risk and Threat Considerations
This vulnerability is materially risky because it turns a trusted email client into an execution point inside the user’s authenticated browser session. In practice, that can expose messages, session state, and any actions the webmail interface is allowed to perform on the user’s behalf.
Failure mechanism: The attacker supplies crafted SVG content that survives filtering and executes browser-side script when the message or preview is rendered.
Impact: The resulting session compromise can support mailbox theft, message manipulation, internal phishing, and broader account abuse from a trusted communications channel.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, OWASP ASVS and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Actively exploited CVE-driven exposure needs prioritised vulnerability tracking and remediation. |
| Recommendation — Prioritise Roundcube exposure, validate reachability, and remediate the vulnerable service quickly. | ||
| OWASP ASVS | V4 — API and Web Service | The flaw is a web application content-handling issue that can execute script in a web UI. |
| Recommendation — Review Roundcube content handling and enforce robust server-side filtering for executable SVG content. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | The vulnerability arises from unsafe handling of attacker-controlled SVG input. |
| AU-2 — Event Logging | Review and investigation depend on visibility into suspicious mailbox and browser-side activity. | |
| IA-5 — Authenticator Management | XSS may expose or abuse session material that depends on authentication state. | |
| Recommendation — Validate and sanitise all webmail-rendered input before it reaches the browser. Log and retain webmail events needed to investigate suspicious message rendering and session abuse. Rotate exposed credentials or session material after confirmed exploitation and review dependent accounts. | ||
Practitioner Guidance
Why practitioners should care: Webmail XSS is not just a browser issue, it is an identity and trust issue because the payload runs inside a live authenticated session. Treat it as a priority whenever the affected system is internet-facing or used for sensitive business mail.
What to watch for: Suspicious SVG-bearing messages, unexpected user actions, unusual mailbox reads, and signs that a compromised mailbox was used to send convincing internal follow-up mail. If those indicators appear, assume the browser session and any mailbox-dependent workflows may need review.
Related resources from NHI Mgmt Group
- CVE-2025-48700 (Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting)
- CVE-2025-66376 (Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting)
- What breaks when a webmail product allows stored cross-site scripting in messages and contacts?
- CVE-2024-11182 (MDaemon Email Server Cross-Site Scripting (XSS))
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org