Roundcube Alert: High-Severity SVG XSS and CSS Sanitizer Flaws Threaten Webmail Privacy

The Roundcube Webmail project has issued security updates for its 1.6 and 1.5 LTS branches to fix two high-severity flaws that could allow attackers to execute malicious scripts or leak sensitive information through emails. Both vulnerabilities carry a CVSS score of 7.2, marking them as “High” risk that administrators should address immediately.

The first vulnerability, CVE-2025-68461, is an XSS flaw hidden in the handling of SVG images, discovered by Valentin T. from CrowdStrike, which could trigger JavaScript execution when a malicious SVG is viewed. The second, CVE-2025-68460, is an information disclosure weakness in Roundcube’s HTML style sanitizer that could allow exfiltration of data from the webmail interface, reported by somerandomdev. Administrators are urged to upgrade to the latest releases in the 1.6 and 1.5 LTS series to close these vectors, according to Roundcube Webmail.