IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.2Alta KEV

CVE-2025-68461RoundCube Webmail Cross-site Scripting Vulnerability

Roundcube Webmail Publicada: (hace 10 meses)

Explotación conocida — RoundCube Webmail Cross-site Scripting Vulnerability

CISA confirmó el 20.02.2026 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 13.03.2026.

Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12 ; https://github.com/roundcube/roundcubemail/commit/bfa032631c36b900e7444dfa278340b33cbf7cdb ; https://nvd.nist.gov/vuln/detail/CVE-2025-68461

Descripción

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.

Debilidad (CWE): CWE-79

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
Roundcube Webmail < 1.5.12, 1.6.0 – < 1.6.12

Referencias y parches

Coincidencias CPE (NVD) (2)
  • cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:* < 1.5.12
  • cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:* ≥ 1.6.0 < 1.6.12

CVE recientes del mismo producto — Roundcube Webmail

6.8Media
CVE-2026-114732
Roundcube Webmail

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qua…

5.3Media
CVE-2026-114731
Roundcube Webmail

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, s…

7.2Alta
CVE-2026-114730
Roundcube Webmail

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 pr…

5.3Media
CVE-2026-114729
Roundcube Webmail

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remot…

5.3Media
CVE-2026-114728
Roundcube Webmail

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern that enumerated only some of its escaped spellings, so valu…

8.3Alta
CVE-2026-114727
Roundcube Webmail

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external res…