roundcube webmail vulnerabilities in 2025, newest first

By year: all 2026 2025 2024 2023 2022 2021

1. 6.1CVE-2025-68461KEVEPSS 27%2025-12-18

   Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.

2. 7.5CVE-2025-68460EPSS 0.3%2025-12-18

   Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.

3. 8.8CVE-2025-49113KEVExploitEPSS 99.6%2025-06-02

   Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

4. 6.1CVE-2024-57004EPSS 41%2025-02-03

   Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering of the XSS by visiting the SENT session.