{"id":"CVE-2025-68460","aliases":["DEBIAN-CVE-2025-68460","DLA-4415-1","DSA-6087-1","EUVD-2025-204036","GHSA-365w-7p77-9f2q","MGASA-2025-0332","UBUNTU-CVE-2025-68460","openSUSE-SU-2026:20323-1"],"status":"published","title":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure...","description":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00284,"percentile":0.21126,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116"],"published":"2025-12-18T00:00:00Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"Debian:12","package":"roundcube","fixed_in":["1.6.5+dfsg-1+deb12u6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"roundcube","fixed_in":["1.6.12+dfsg-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"roundcube","fixed_in":["1.6.12+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1+deb12u6"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1","1.6.3+dfsg-1","1.6.3+dfsg-1~deb12u1","1.6.3+dfsg-2","1.6.4+dfsg-1","1.6.4+dfsg-1~deb12u1","1.6.5+dfsg-1","1.6.5+dfsg-1+deb12u2","1.6.5+dfsg-1+deb12u3","1.6.5+dfsg-1+deb12u4","1.6.5+dfsg-1+deb12u5","1.6.5+dfsg-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12+dfsg-0+deb13u1"}]}],"versions":["1.6.11+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12+dfsg-1"}]}],"versions":["1.6.11+dfsg-1"]},{"source":"osv","ecosystem":"Debian:11","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15+dfsg.1-1+deb11u6"}]}],"versions":["1.4.11+dfsg.1-4","1.4.12+dfsg.1-1~bpo10+1","1.4.12+dfsg.1-1~deb11u1","1.4.13+dfsg.1-1~deb11u1","1.4.13+dfsg.1-1~deb11u1~bpo10+1","1.4.14+dfsg.1-1~deb11u1","1.4.14+dfsg.1-1~deb11u1~bpo10+1","1.4.15+dfsg.1-1+deb11u3","1.4.15+dfsg.1-1+deb11u4","1.4.15+dfsg.1-1+deb11u5","1.4.15+dfsg.1-1~deb11u1","1.4.15+dfsg.1-1~deb11u1~bpo10+1","1.4.15+dfsg.1-1~deb11u2","1.4.15+dfsg.1-1~deb11u2~bpo10+1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1+deb12u6"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1","1.6.3+dfsg-1","1.6.3+dfsg-1~deb12u1","1.6.3+dfsg-2","1.6.4+dfsg-1","1.6.4+dfsg-1~deb12u1","1.6.5+dfsg-1","1.6.5+dfsg-1+deb12u2","1.6.5+dfsg-1+deb12u3","1.6.5+dfsg-1+deb12u4","1.6.5+dfsg-1+deb12u5","1.6.5+dfsg-1~deb12u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:13","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12+dfsg-0+deb13u1"}]}],"versions":["1.6.11+dfsg-1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.10+dfsg-1","1.6.10+dfsg-2","1.6.11+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.11+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.11+dfsg-1","1.6.11+dfsg-1ubuntu0.26.04.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.13-bp160.1.1"}]}],"bundled":4}],"products":[{"vendor":"bulwarkmail","product":"webmail"},{"vendor":"roundcube","product":"webmail"}],"references":[{"url":"https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12","tags":["Vendor Advisory","web","report"]},{"url":"https://github.com/roundcube/roundcubemail/commit/08de250fba731b634bed188bbe18d2f6ef3c7571","tags":["Patch","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68460","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-365w-7p77-9f2q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68460.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-68460","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0332.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34863","tags":["report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.12","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-68460","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68460","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1255306","tags":["report"]},{"url":"https://bugzilla.suse.com/1255308","tags":["report"]},{"url":"https://bugzilla.suse.com/1257909","tags":["report"]},{"url":"https://bugzilla.suse.com/1258052","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26079","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-68460","description":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.","status":"published","published":"2025-12-18T04:54:13.338Z","modified":"2025-12-18T18:53:53.491Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:32:36.079745Z"}],"euvd":[{"id":"EUVD-2025-204036","description":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.","status":"published","published":"2025-12-18T04:54:13Z","modified":"2025-12-18T18:53:53Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:03.071772Z"}],"ghsa":[{"id":"GHSA-365w-7p77-9f2q","title":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure...","description":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.","status":"published","published":"2025-12-18T06:30:13Z","modified":"2025-12-18T06:30:19Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:05:16.313648Z"}],"nvd":[{"id":"CVE-2025-68460","description":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.","status":"published","published":"2025-12-18T05:15:52.737Z","modified":"2026-06-17T09:59:06.18Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:11:51.309584Z"}],"osv":[{"id":"CVE-2025-68460","description":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.","status":"published","published":"2025-12-18T04:54:13.338Z","modified":"2026-10-28T02:30:54.549984073Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:44:52.53036Z"},{"id":"DEBIAN-CVE-2025-68460","description":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.","status":"published","published":"2025-12-18T05:15:52.737Z","modified":"2026-09-01T20:05:57.335906305Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:48.025964Z"},{"id":"UBUNTU-CVE-2025-68460","description":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.","status":"published","published":"2025-12-18T05:15:00Z","modified":"2026-10-17T12:57:30.919916663Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:52.345622Z"},{"id":"DLA-4415-1","title":"roundcube - security update","status":"published","published":"2025-12-18T00:00:00Z","modified":"2025-12-18T15:14:51.311757Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-6087-1","title":"roundcube - security update","status":"published","published":"2025-12-19T00:00:00Z","modified":"2025-12-19T22:14:53.000999Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0332","title":"Updated roundcubemail packages fix security vulnerabilities","description":"Fix Cross-Site-Scripting vulnerability via SVG's animate tag reported by\nValentin T., CrowdStrike.\nFix Information Disclosure vulnerability in the HTML style sanitizer\nreported by somerandomdev.\n","status":"published","published":"2025-12-22T23:57:14Z","modified":"2026-04-16T04:40:45.364104046Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:20323-1","title":"Security update for roundcubemail","description":"This update for roundcubemail fixes the following issues:\n\nChanges to roundcubemail:\n\nUpdate to 1.6.13:\n\n  This is a security update to the stable version 1.6 of Roundcube Webmail.\n  It provides fixes to recently reported security vulnerabilities:\n  + Fix CSS injection vulnerability reported by CERT Polska (boo#1258052,\n    CVE-2026-26079).\n  + Fix remote image blocking bypass via SVG content reported by nullcathedral\n    (boo#1257909, CVE-2026-25916).\n\n  This version is considered stable and we recommend to update all productive\n  installations of Roundcube 1.6.x with it. Please do backup your data\n  before updating!\n\n  CHANGELOG\n  + Managesieve: Fix handling of string-list format values for date\n    tests in Out of Office (#10075)\n  + Fix CSS injection vulnerability reported by CERT Polska.\n  + Fix remote image blocking bypass via SVG content reported by nullcathedral.\n\nUpdate to 1.6.12:\n\n  This is a security update to the stable version 1.6 of Roundcube Webmail.\n  It provides fixes to recently reported security vulnerabilities:\n\n  + Fix Cross-Site-Scripting vulnerability via SVG's animate tag\n    reported by Valentin T., CrowdStrike (boo#1255308, CVE-2025-68461).\n  + Fix Information Disclosure vulnerability in the HTML style\n    sanitizer reported by somerandomdev (boo#1255306, CVE-2025-68460).\n\n  This version is considered stable and we recommend to update all\n  productive installations of Roundcube 1.6.x with it.\n\n  + Support IPv6 in database DSN (#9937)\n  + Don't force specific error_reporting setting\n  + Fix compatibility with PHP 8.5 regarding array_first()\n  + Remove X-XSS-Protection example from .htaccess file (#9875)\n  + Fix \"Assign to group\" action state after creation of a first group (#9889)\n  + Fix bug where contacts search would fail if contactlist_fields contained vcard fields (#9850)\n  + Fix bug where an mbox export file could include inconsistent message delimiters (#9879)\n  + Fix parsing of inline styles that aren't well-formatted (#9948)\n  + Fix Cross-Site-Scripting vulnerability via SVG's animate tag\n  + Fix Information Disclosure vulnerability in the HTML style sanitizer\n\nUpdate to 1.6.11\n\n  This is a security update to the stable version 1.6 of Roundcube Webmail.\n  It provides fixes to recently reported security vulnerabilities:\n  * Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v.\n\n- CHANGELOG\n  * Managesieve: Fix match-type selector (remove unsupported options) in delete header action (#9610)\n  * Improve installer to fix confusion about disabling SMTP authentication (#9801)\n  * Fix PHP warning in index.php (#9813)\n  * OAuth: Fix/improve token refresh\n  * Fix dark mode bug where wrong colors were used for blockquotes in HTML mail preview (#9820)\n  * Fix HTML message preview if it contains floating tables (#9804)\n  * Fix removing/expiring redis/memcache records when using a key prefix\n  * Fix bug where a wrong SPECIAL-USE folder could have been detected, if there were more than one per-type (#9781)\n  * Fix a default value and documentation of password_ldap_encodage option (#9658)\n  * Remove mobile/floating Create button from the list in Settings \u003e Folders (#9661)\n  * Fix Delete and Empty buttons state while creating a folder (#9047)\n  * Fix connecting to LDAP using ldapi:// URI (#8990)\n  * Fix cursor position on \"below the quote\" reply in HTML mode (#8700)\n  * Fix bug where attachments with content type of application/vnd.ms-tnef were not parsed (#7119)\n\nUpdate to 1.6.10:\n\n  This is the next service release to update the stable version 1.6.\n  * IMAP: Partial support for ANNOTATE-EXPERIMENT-1 extension (RFC 5257)\n  * OAuth: Support standard authentication with short-living password received with OIDC token (#9530)\n  * Fix PHP warnings (#9616, #9611)\n  * Fix whitespace handling in vCard line continuation (#9637)\n  * Fix current script state after initial scripts creation in managesieve_kolab_master mode\n  * Fix rcube_imap::get_vendor() result (and PHP warning) on Zimbra server (#9650)\n  * Fix regression causing inline SVG images to be missing in mail preview (#9644)\n  * Fix plugin \"virtuser_file\" to handle backward slashes in username (#9668)\n  * Fix PHP fatal error when parsing some malformed BODYSTRUCTURE responses (#9689)\n  * Fix insert_or_update() and reading database server config on PostgreSQL (#9710)\n  * Fix Oauth issues with use_secure_urls=true (#9722)\n  * Fix handling of binary mail parts (e.g. PDF) encoded with quoted-printable (#9728)\n  * Fix links in comments and config to https:// where available (#9759, #9756)\n  * Fix decoding of attachment names encoded using both RFC2231 and RFC2047 standards (#9725)\n","status":"published","published":"2026-03-05T18:31:03Z","modified":"2026-03-23T04:54:50.920443Z","updated_at":"2026-11-02T16:58:41.463445Z"}]}}