{"id":"CVE-2025-68461","aliases":["DEBIAN-CVE-2025-68461","DLA-4415-1","DSA-6087-1","EUVD-2025-204035","GHSA-qqrg-hpxx-mmvw","MGASA-2025-0332","UBUNTU-CVE-2025-68461","USN-8097-1","USN-8482-1","openSUSE-SU-2026:20323-1"],"status":"published","title":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS)...","description":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.27407,"percentile":0.9808,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2025-12-18T00:00:00Z","modified":"2026-10-28T02:30:34Z","kev":{"date_added":"2026-02-20","due_date":"2026-03-13","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2026-02-20"},{"source":"kev","since":"2026-02-20"}],"exploits":[{"source":"pocgithub","id":"rxerium/CVE-2025-68461","title":"rxerium/CVE-2025-68461","date":"2025-12-19","url":"https://github.com/rxerium/CVE-2025-68461"},{"source":"pocgithub","id":"gotr00t0day/CVE-2025-68461","title":"gotr00t0day/CVE-2025-68461","date":"2025-12-22","url":"https://github.com/gotr00t0day/CVE-2025-68461"}],"fixes":[{"ecosystem":"Debian:12","package":"roundcube","fixed_in":["1.6.5+dfsg-1+deb12u6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"roundcube","fixed_in":["1.6.12+dfsg-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"roundcube","fixed_in":["1.6.12+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"roundcube","fixed_in":["1.3.6+dfsg.1-1ubuntu0.1~esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","fixed_in":["1.4.3+dfsg.1-1ubuntu0.1~esm7","1.4.3+dfsg.1-1ubuntu0.1~esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","fixed_in":["1.5.0+dfsg.1-2ubuntu0.1~esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"roundcube","fixed_in":["1.6.6+dfsg-2ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"roundcube","fixed_in":["1.6.11+dfsg-1ubuntu0.26.04.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1+deb12u6"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1","1.6.3+dfsg-1","1.6.3+dfsg-1~deb12u1","1.6.3+dfsg-2","1.6.4+dfsg-1","1.6.4+dfsg-1~deb12u1","1.6.5+dfsg-1","1.6.5+dfsg-1+deb12u2","1.6.5+dfsg-1+deb12u3","1.6.5+dfsg-1+deb12u4","1.6.5+dfsg-1+deb12u5","1.6.5+dfsg-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12+dfsg-0+deb13u1"}]}],"versions":["1.6.11+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12+dfsg-1"}]}],"versions":["1.6.11+dfsg-1"]},{"source":"osv","ecosystem":"Debian:11","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15+dfsg.1-1+deb11u6"}]}],"versions":["1.4.11+dfsg.1-4","1.4.12+dfsg.1-1~bpo10+1","1.4.12+dfsg.1-1~deb11u1","1.4.13+dfsg.1-1~deb11u1","1.4.13+dfsg.1-1~deb11u1~bpo10+1","1.4.14+dfsg.1-1~deb11u1","1.4.14+dfsg.1-1~deb11u1~bpo10+1","1.4.15+dfsg.1-1+deb11u3","1.4.15+dfsg.1-1+deb11u4","1.4.15+dfsg.1-1+deb11u5","1.4.15+dfsg.1-1~deb11u1","1.4.15+dfsg.1-1~deb11u1~bpo10+1","1.4.15+dfsg.1-1~deb11u2","1.4.15+dfsg.1-1~deb11u2~bpo10+1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1+deb12u6"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1","1.6.3+dfsg-1","1.6.3+dfsg-1~deb12u1","1.6.3+dfsg-2","1.6.4+dfsg-1","1.6.4+dfsg-1~deb12u1","1.6.5+dfsg-1","1.6.5+dfsg-1+deb12u2","1.6.5+dfsg-1+deb12u3","1.6.5+dfsg-1+deb12u4","1.6.5+dfsg-1+deb12u5","1.6.5+dfsg-1~deb12u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:13","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12+dfsg-0+deb13u1"}]}],"versions":["1.6.11+dfsg-1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6+dfsg.1-1ubuntu0.1~esm6"}]}],"versions":["1.3.0+dfsg.1-1","1.3.1+dfsg.1-1","1.3.3+dfsg.1-1","1.3.3+dfsg.1-2","1.3.6+dfsg.1-1","1.3.6+dfsg.1-1ubuntu0.1~esm1","1.3.6+dfsg.1-1ubuntu0.1~esm2","1.3.6+dfsg.1-1ubuntu0.1~esm3","1.3.6+dfsg.1-1ubuntu0.1~esm4","1.3.6+dfsg.1-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg.1-1ubuntu0.1~esm7"}]}],"versions":["1.3.8+dfsg.1-2","1.3.10+dfsg.1-1","1.4.1+dfsg.1-2","1.4.2+dfsg.1-1","1.4.2+dfsg.1-2","1.4.3+dfsg.1-1","1.4.3+dfsg.1-1ubuntu0.1~esm1","1.4.3+dfsg.1-1ubuntu0.1~esm2","1.4.3+dfsg.1-1ubuntu0.1~esm3","1.4.3+dfsg.1-1ubuntu0.1~esm4","1.4.3+dfsg.1-1ubuntu0.1~esm5","1.4.3+dfsg.1-1ubuntu0.1~esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0+dfsg.1-2ubuntu0.1~esm5"}]}],"versions":["1.4.11+dfsg.1-4","1.5.0+dfsg.1-2","1.5.0+dfsg.1-2ubuntu0.1~esm1","1.5.0+dfsg.1-2ubuntu0.1~esm2","1.5.0+dfsg.1-2ubuntu0.1~esm3","1.5.0+dfsg.1-2ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6+dfsg-2ubuntu0.1+esm2"}]}],"versions":["1.6.2+dfsg-1","1.6.4+dfsg-1","1.6.5+dfsg-1","1.6.6+dfsg-1","1.6.6+dfsg-2","1.6.6+dfsg-2ubuntu0.1","1.6.6+dfsg-2ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.10+dfsg-1","1.6.10+dfsg-2","1.6.11+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.11+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11+dfsg-1ubuntu0.26.04.1~esm1"}]}],"versions":["1.6.11+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6+dfsg.1-1ubuntu0.1~esm6"}]}],"versions":["1.3.0+dfsg.1-1","1.3.1+dfsg.1-1","1.3.3+dfsg.1-1","1.3.3+dfsg.1-2","1.3.6+dfsg.1-1","1.3.6+dfsg.1-1ubuntu0.1~esm1","1.3.6+dfsg.1-1ubuntu0.1~esm2","1.3.6+dfsg.1-1ubuntu0.1~esm3","1.3.6+dfsg.1-1ubuntu0.1~esm4","1.3.6+dfsg.1-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg.1-1ubuntu0.1~esm6"}]}],"versions":["1.3.8+dfsg.1-2","1.3.10+dfsg.1-1","1.4.1+dfsg.1-2","1.4.2+dfsg.1-1","1.4.2+dfsg.1-2","1.4.3+dfsg.1-1","1.4.3+dfsg.1-1ubuntu0.1~esm1","1.4.3+dfsg.1-1ubuntu0.1~esm2","1.4.3+dfsg.1-1ubuntu0.1~esm3","1.4.3+dfsg.1-1ubuntu0.1~esm4","1.4.3+dfsg.1-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0+dfsg.1-2ubuntu0.1~esm5"}]}],"versions":["1.4.11+dfsg.1-4","1.5.0+dfsg.1-2","1.5.0+dfsg.1-2ubuntu0.1~esm1","1.5.0+dfsg.1-2ubuntu0.1~esm2","1.5.0+dfsg.1-2ubuntu0.1~esm3","1.5.0+dfsg.1-2ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6+dfsg-2ubuntu0.1+esm2"}]}],"versions":["1.6.2+dfsg-1","1.6.4+dfsg-1","1.6.5+dfsg-1","1.6.6+dfsg-1","1.6.6+dfsg-2","1.6.6+dfsg-2ubuntu0.1","1.6.6+dfsg-2ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11+dfsg-1ubuntu0.26.04.1~esm1"}]}],"versions":["1.6.11+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.13-bp160.1.1"}]}],"bundled":4}],"products":[{"vendor":"bulwarkmail","product":"webmail"},{"vendor":"roundcube","product":"webmail"}],"references":[{"url":"https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12","tags":["Vendor Advisory","web","report"]},{"url":"https://github.com/roundcube/roundcubemail/commit/bfa032631c36b900e7444dfa278340b33cbf7cdb","tags":["Patch","fix","report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68461","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68461","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qqrg-hpxx-mmvw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68461.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-68461","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0332.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34863","tags":["report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.12","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-68461","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68461","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8482-1","tags":["advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8097-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1255306","tags":["report"]},{"url":"https://bugzilla.suse.com/1255308","tags":["report"]},{"url":"https://bugzilla.suse.com/1257909","tags":["report"]},{"url":"https://bugzilla.suse.com/1258052","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26079","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-68461","description":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.","status":"published","published":"2025-12-18T05:00:54.423Z","modified":"2026-10-01T18:12:05.532Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:35.742256Z"}],"euvd":[{"id":"EUVD-2025-204035","description":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.","status":"published","published":"2025-12-18T05:00:54Z","modified":"2026-10-01T18:12:05Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"exploited_since":"2026-02-20","updated_at":"2026-11-02T17:27:44.322377Z"}],"ghsa":[{"id":"GHSA-qqrg-hpxx-mmvw","title":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS)...","description":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.","status":"published","published":"2025-12-18T06:30:13Z","modified":"2026-02-20T21:31:16Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:06:18.00539Z"}],"kev":[{"id":"CVE-2025-68461","title":"RoundCube Webmail Cross-site Scripting Vulnerability","description":"RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.","cwes":["CWE-79"],"kev":{"date_added":"2026-02-20","due_date":"2026-03-13","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2025-68461","description":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.","status":"published","published":"2025-12-18T05:15:56.623Z","modified":"2026-06-17T09:59:06.3Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:51.309584Z"}],"osv":[{"id":"CVE-2025-68461","description":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.","status":"published","published":"2025-12-18T05:00:54.423Z","modified":"2026-10-28T02:30:34.623525251Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:52.53036Z"},{"id":"DEBIAN-CVE-2025-68461","description":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.","status":"published","published":"2025-12-18T05:15:56.623Z","modified":"2026-09-01T20:05:57.439631513Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:48.025964Z"},{"id":"UBUNTU-CVE-2025-68461","description":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.","status":"published","published":"2025-12-18T05:15:00Z","modified":"2026-10-17T12:57:30.870302507Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:52.345622Z"},{"id":"DLA-4415-1","title":"roundcube - security update","status":"published","published":"2025-12-18T00:00:00Z","modified":"2025-12-18T15:14:51.311757Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-6087-1","title":"roundcube - security update","status":"published","published":"2025-12-19T00:00:00Z","modified":"2025-12-19T22:14:53.000999Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0332","title":"Updated roundcubemail packages fix security vulnerabilities","description":"Fix Cross-Site-Scripting vulnerability via SVG's animate tag reported by\nValentin T., CrowdStrike.\nFix Information Disclosure vulnerability in the HTML style sanitizer\nreported by somerandomdev.\n","status":"published","published":"2025-12-22T23:57:14Z","modified":"2026-04-16T04:40:45.364104046Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:20323-1","title":"Security update for roundcubemail","description":"This update for roundcubemail fixes the following issues:\n\nChanges to roundcubemail:\n\nUpdate to 1.6.13:\n\n  This is a security update to the stable version 1.6 of Roundcube Webmail.\n  It provides fixes to recently reported security vulnerabilities:\n  + Fix CSS injection vulnerability reported by CERT Polska (boo#1258052,\n    CVE-2026-26079).\n  + Fix remote image blocking bypass via SVG content reported by nullcathedral\n    (boo#1257909, CVE-2026-25916).\n\n  This version is considered stable and we recommend to update all productive\n  installations of Roundcube 1.6.x with it. Please do backup your data\n  before updating!\n\n  CHANGELOG\n  + Managesieve: Fix handling of string-list format values for date\n    tests in Out of Office (#10075)\n  + Fix CSS injection vulnerability reported by CERT Polska.\n  + Fix remote image blocking bypass via SVG content reported by nullcathedral.\n\nUpdate to 1.6.12:\n\n  This is a security update to the stable version 1.6 of Roundcube Webmail.\n  It provides fixes to recently reported security vulnerabilities:\n\n  + Fix Cross-Site-Scripting vulnerability via SVG's animate tag\n    reported by Valentin T., CrowdStrike (boo#1255308, CVE-2025-68461).\n  + Fix Information Disclosure vulnerability in the HTML style\n    sanitizer reported by somerandomdev (boo#1255306, CVE-2025-68460).\n\n  This version is considered stable and we recommend to update all\n  productive installations of Roundcube 1.6.x with it.\n\n  + Support IPv6 in database DSN (#9937)\n  + Don't force specific error_reporting setting\n  + Fix compatibility with PHP 8.5 regarding array_first()\n  + Remove X-XSS-Protection example from .htaccess file (#9875)\n  + Fix \"Assign to group\" action state after creation of a first group (#9889)\n  + Fix bug where contacts search would fail if contactlist_fields contained vcard fields (#9850)\n  + Fix bug where an mbox export file could include inconsistent message delimiters (#9879)\n  + Fix parsing of inline styles that aren't well-formatted (#9948)\n  + Fix Cross-Site-Scripting vulnerability via SVG's animate tag\n  + Fix Information Disclosure vulnerability in the HTML style sanitizer\n\nUpdate to 1.6.11\n\n  This is a security update to the stable version 1.6 of Roundcube Webmail.\n  It provides fixes to recently reported security vulnerabilities:\n  * Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v.\n\n- CHANGELOG\n  * Managesieve: Fix match-type selector (remove unsupported options) in delete header action (#9610)\n  * Improve installer to fix confusion about disabling SMTP authentication (#9801)\n  * Fix PHP warning in index.php (#9813)\n  * OAuth: Fix/improve token refresh\n  * Fix dark mode bug where wrong colors were used for blockquotes in HTML mail preview (#9820)\n  * Fix HTML message preview if it contains floating tables (#9804)\n  * Fix removing/expiring redis/memcache records when using a key prefix\n  * Fix bug where a wrong SPECIAL-USE folder could have been detected, if there were more than one per-type (#9781)\n  * Fix a default value and documentation of password_ldap_encodage option (#9658)\n  * Remove mobile/floating Create button from the list in Settings \u003e Folders (#9661)\n  * Fix Delete and Empty buttons state while creating a folder (#9047)\n  * Fix connecting to LDAP using ldapi:// URI (#8990)\n  * Fix cursor position on \"below the quote\" reply in HTML mode (#8700)\n  * Fix bug where attachments with content type of application/vnd.ms-tnef were not parsed (#7119)\n\nUpdate to 1.6.10:\n\n  This is the next service release to update the stable version 1.6.\n  * IMAP: Partial support for ANNOTATE-EXPERIMENT-1 extension (RFC 5257)\n  * OAuth: Support standard authentication with short-living password received with OIDC token (#9530)\n  * Fix PHP warnings (#9616, #9611)\n  * Fix whitespace handling in vCard line continuation (#9637)\n  * Fix current script state after initial scripts creation in managesieve_kolab_master mode\n  * Fix rcube_imap::get_vendor() result (and PHP warning) on Zimbra server (#9650)\n  * Fix regression causing inline SVG images to be missing in mail preview (#9644)\n  * Fix plugin \"virtuser_file\" to handle backward slashes in username (#9668)\n  * Fix PHP fatal error when parsing some malformed BODYSTRUCTURE responses (#9689)\n  * Fix insert_or_update() and reading database server config on PostgreSQL (#9710)\n  * Fix Oauth issues with use_secure_urls=true (#9722)\n  * Fix handling of binary mail parts (e.g. PDF) encoded with quoted-printable (#9728)\n  * Fix links in comments and config to https:// where available (#9759, #9756)\n  * Fix decoding of attachment names encoded using both RFC2231 and RFC2047 standards (#9725)\n","status":"published","published":"2026-03-05T18:31:03Z","modified":"2026-03-23T04:54:50.920443Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"USN-8097-1","title":"roundcube vulnerabilities","description":"It was discovered that Roundcube Webmail did not properly sanitize the\nanimate tag within SVG documents. An attacker could possibly use\nthis issue to cause a cross-site scripting attack.","status":"published","published":"2026-03-16T15:28:13Z","modified":"2026-04-27T18:43:21.552178Z","updated_at":"2026-11-02T16:58:22.951676Z"},{"id":"USN-8482-1","title":"roundcube vulnerability","description":"It was discovered that Roundcube Webmail was prone to a Cross-Site-Scripting\n(XSS) vulnerability via the animate tag in an SVG document. An attacker\ncould use this issue to execute arbitrary web script in the context of an \naffected user's session.","status":"published","published":"2026-06-30T08:41:53Z","modified":"2026-06-30T14:14:25.943574097Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}