CVE-2025-68461
roundcube: Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the...
CVE-2025-68461 is fixed in 7 products on 1 platform, first by roundcube 1.3.6+dfsg.1-1ubuntu0.1~esm6, released December 17, 2025. It is being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on February 20, 2026. Patch Radar priority: Patch now.
Patch nowCISA KEV
CVSS
6.1
High
Exploitation
Exploited
Listed by CISA
CISA KEV
Feb 20, 2026
Federal due date Mar 13, 2026
EPSS
0.2741
98th percentile
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| roundcube · Debian 12.15 (bookworm) | 1.6.5+dfsg-1+deb12u6 | DEBIAN-CVE-2025-68461 | Dec 18, 2025 |
| roundcube · Debian 13.5 (trixie) | 1.6.12+dfsg-0+deb13u1 | DEBIAN-CVE-2025-68461 | Dec 18, 2025 |
| roundcube · Debian 14 | 1.6.12+dfsg-1 | DEBIAN-CVE-2025-68461 | Dec 18, 2025 |
| roundcube · Ubuntu 18.04.6 LTS (bionic) | 1.3.6+dfsg.1-1ubuntu0.1~esm6 | roundcube 1.3.6+dfsg.1-1ubuntu0.1~esm6 | Dec 17, 2025 |
| roundcube · Ubuntu 20.04 LTS (focal) | 1.4.3+dfsg.1-1ubuntu0.1~esm7 | roundcube 1.4.3+dfsg.1-1ubuntu0.1~esm7 | Dec 17, 2025 |
| roundcube · Ubuntu 22.04.1 LTS (jammy) | 1.5.0+dfsg.1-2ubuntu0.1~esm5 | roundcube 1.5.0+dfsg.1-2ubuntu0.1~esm5 | Dec 17, 2025 |
| roundcube · Ubuntu 24.04.5 LTS (noble) | 1.6.6+dfsg-2ubuntu0.1+esm2 | roundcube 1.6.6+dfsg-2ubuntu0.1+esm2 | Dec 17, 2025 |
| roundcube · Ubuntu 26.04.1 LTS (resolute) | 1.6.11+dfsg-1ubuntu0.26.04.1~esm1 | roundcube 1.6.11+dfsg-1ubuntu0.26.04.1~esm1 | Dec 17, 2025 |
| roundcube-core · Ubuntu 18.04.6 LTS (bionic) | 1.3.6+dfsg.1-1ubuntu0.1~esm6 | roundcube-core 1.3.6+dfsg.1-1ubuntu0.1~esm6 | Dec 17, 2025 |
| roundcube-core · Ubuntu 20.04 LTS (focal) | 1.4.3+dfsg.1-1ubuntu0.1~esm7 | roundcube-core 1.4.3+dfsg.1-1ubuntu0.1~esm7 | Dec 17, 2025 |
| roundcube-core · Ubuntu 22.04.1 LTS (jammy) | 1.5.0+dfsg.1-2ubuntu0.1~esm5 | roundcube-core 1.5.0+dfsg.1-2ubuntu0.1~esm5 | Dec 17, 2025 |
| roundcube-core · Ubuntu 24.04.5 LTS (noble) | 1.6.6+dfsg-2ubuntu0.1+esm2 | roundcube-core 1.6.6+dfsg-2ubuntu0.1+esm2 | Dec 17, 2025 |
| roundcube-core · Ubuntu 26.04.1 LTS (resolute) | 1.6.11+dfsg-1ubuntu0.26.04.1~esm1 | roundcube-core 1.6.11+dfsg-1ubuntu0.26.04.1~esm1 | Dec 17, 2025 |
| roundcube-mysql · Ubuntu 18.04.6 LTS (bionic) | 1.3.6+dfsg.1-1ubuntu0.1~esm6 | roundcube-mysql 1.3.6+dfsg.1-1ubuntu0.1~esm6 | Dec 17, 2025 |
| roundcube-mysql · Ubuntu 20.04 LTS (focal) | 1.4.3+dfsg.1-1ubuntu0.1~esm7 | roundcube-mysql 1.4.3+dfsg.1-1ubuntu0.1~esm7 | Dec 17, 2025 |
| roundcube-mysql · Ubuntu 22.04.1 LTS (jammy) | 1.5.0+dfsg.1-2ubuntu0.1~esm5 | roundcube-mysql 1.5.0+dfsg.1-2ubuntu0.1~esm5 | Dec 17, 2025 |
| roundcube-mysql · Ubuntu 24.04.5 LTS (noble) | 1.6.6+dfsg-2ubuntu0.1+esm2 | roundcube-mysql 1.6.6+dfsg-2ubuntu0.1+esm2 | Dec 17, 2025 |
| roundcube-mysql · Ubuntu 26.04.1 LTS (resolute) | 1.6.11+dfsg-1ubuntu0.26.04.1~esm1 | roundcube-mysql 1.6.11+dfsg-1ubuntu0.26.04.1~esm1 | Dec 17, 2025 |
| roundcube-pgsql · Ubuntu 18.04.6 LTS (bionic) | 1.3.6+dfsg.1-1ubuntu0.1~esm6 | roundcube-pgsql 1.3.6+dfsg.1-1ubuntu0.1~esm6 | Dec 17, 2025 |
| roundcube-pgsql · Ubuntu 20.04 LTS (focal) | 1.4.3+dfsg.1-1ubuntu0.1~esm7 | roundcube-pgsql 1.4.3+dfsg.1-1ubuntu0.1~esm7 | Dec 17, 2025 |
| roundcube-pgsql · Ubuntu 22.04.1 LTS (jammy) | 1.5.0+dfsg.1-2ubuntu0.1~esm5 | roundcube-pgsql 1.5.0+dfsg.1-2ubuntu0.1~esm5 | Dec 17, 2025 |
| roundcube-pgsql · Ubuntu 24.04.5 LTS (noble) | 1.6.6+dfsg-2ubuntu0.1+esm2 | roundcube-pgsql 1.6.6+dfsg-2ubuntu0.1+esm2 | Dec 17, 2025 |
| roundcube-pgsql · Ubuntu 26.04.1 LTS (resolute) | 1.6.11+dfsg-1ubuntu0.26.04.1~esm1 | roundcube-pgsql 1.6.11+dfsg-1ubuntu0.26.04.1~esm1 | Dec 17, 2025 |
| roundcube-plugins · Ubuntu 18.04.6 LTS (bionic) | 1.3.6+dfsg.1-1ubuntu0.1~esm6 | roundcube-plugins 1.3.6+dfsg.1-1ubuntu0.1~esm6 | Dec 17, 2025 |
| roundcube-plugins · Ubuntu 20.04 LTS (focal) | 1.4.3+dfsg.1-1ubuntu0.1~esm7 | roundcube-plugins 1.4.3+dfsg.1-1ubuntu0.1~esm7 | Dec 17, 2025 |
| roundcube-plugins · Ubuntu 22.04.1 LTS (jammy) | 1.5.0+dfsg.1-2ubuntu0.1~esm5 | roundcube-plugins 1.5.0+dfsg.1-2ubuntu0.1~esm5 | Dec 17, 2025 |
| roundcube-plugins · Ubuntu 24.04.5 LTS (noble) | 1.6.6+dfsg-2ubuntu0.1+esm2 | roundcube-plugins 1.6.6+dfsg-2ubuntu0.1+esm2 | Dec 17, 2025 |
| roundcube-plugins · Ubuntu 26.04.1 LTS (resolute) | 1.6.11+dfsg-1ubuntu0.26.04.1~esm1 | roundcube-plugins 1.6.11+dfsg-1ubuntu0.26.04.1~esm1 | Dec 17, 2025 |
| roundcube-sqlite3 · Ubuntu 18.04.6 LTS (bionic) | 1.3.6+dfsg.1-1ubuntu0.1~esm6 | roundcube-sqlite3 1.3.6+dfsg.1-1ubuntu0.1~esm6 | Dec 17, 2025 |
| roundcube-sqlite3 · Ubuntu 20.04 LTS (focal) | 1.4.3+dfsg.1-1ubuntu0.1~esm7 | roundcube-sqlite3 1.4.3+dfsg.1-1ubuntu0.1~esm7 | Dec 17, 2025 |
| roundcube-sqlite3 · Ubuntu 22.04.1 LTS (jammy) | 1.5.0+dfsg.1-2ubuntu0.1~esm5 | roundcube-sqlite3 1.5.0+dfsg.1-2ubuntu0.1~esm5 | Dec 17, 2025 |
| roundcube-sqlite3 · Ubuntu 24.04.5 LTS (noble) | 1.6.6+dfsg-2ubuntu0.1+esm2 | roundcube-sqlite3 1.6.6+dfsg-2ubuntu0.1+esm2 | Dec 17, 2025 |
| roundcube-sqlite3 · Ubuntu 26.04.1 LTS (resolute) | 1.6.11+dfsg-1ubuntu0.26.04.1~esm1 | roundcube-sqlite3 1.6.11+dfsg-1ubuntu0.26.04.1~esm1 | Dec 17, 2025 |
| roundcubemail · opensuse-leap 16.0 | 1.6.13-bp160.1.1 | OPENSUSE-SU-2026:20323-1 | Mar 5, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.