# CVE-2025-68461

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.

- Page: https://www.vulneraibility.com/cve/CVE-2025-68461
- CVSS: 7.2
- Known exploited: yes, in CISA KEV since 2026-02-20; CISA due date 2026-03-13
- EPSS: 27.41%
- Unvetted proof-of-concept code on GitHub: 2 GitHub proofs of concept (first 2025-12-19)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2026-02-21)
- Weakness: CWE-79
- Published: 2025-12-18

## Affected versions

- Roundcube Webmail: affected < 1.5.12; >= 1.6.0 and < 1.6.12

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12
- [other] https://github.com/roundcube/roundcubemail/commit/bfa032631c36b900e7444dfa278340b33cbf7cdb
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68461

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.