CVE-2025-68461: Roundcube Webmail SVG Animate Tag Enables Stored XSS Attack

CVE ID: CVE-2025-68461 Vendor: Roundcube Product: Roundcube Webmail Vulnerability Type: Cross-Site Scripting (XSS) Attack Vector: Network CISA KEV Patch Deadline: 2026-03-13 (Federal agencies)

Vulnerability Overview

Roundcube Webmail contains a cross-site scripting vulnerability rooted in insufficient sanitization of the <animate> tag within SVG documents. An attacker can embed a crafted SVG payload — either as an email attachment or inline content — that executes arbitrary JavaScript in the victim's browser under the context of their authenticated session.

The flaw exists because Roundcube's HTML sanitization pipeline does not adequately strip or neutralize the SVG <animate> element before rendering. SVG is an XML-based vector format that supports embedded scripting and animation directives. When Roundcube renders a message containing a malicious SVG, the browser processes the <animate> tag and any injected JavaScript executes with full access to the user's session context.

Technical Details

The attack surface is the email preview and rendering engine within Roundcube Webmail. An attacker constructs an SVG document embedding JavaScript via the <animate> tag and delivers it to a target Roundcube user. No additional user interaction beyond opening or previewing the email is required in configurations where SVG rendering is enabled inline.

Successful exploitation gives the attacker JavaScript execution in the victim's browser session. From that position, the attacker can:

  • Steal session cookies to achieve full session hijacking
  • Exfiltrate CSRF tokens, enabling cross-site request forgery against the webmail application
  • Perform authenticated actions on behalf of the victim, including reading emails, forwarding messages, or modifying account settings
  • Pivot to phishing by injecting malicious UI elements within the trusted webmail context

Because the payload is delivered through email — a trusted communication channel — users have no inherent reason to suspect the content before it renders.

Affected Products

The vulnerability affects Roundcube Webmail. Organizations running self-hosted Roundcube instances are directly exposed. Shared hosting providers and managed email services that deploy Roundcube on behalf of customers amplify the blast radius considerably, as a single unpatched instance can expose all users on that server.

Real-World Impact

Roundcube has a documented history of being targeted by advanced persistent threat groups. APT28 (Fancy Bear) exploited Roundcube vulnerabilities in prior campaigns to harvest credentials and email content from government and defense-sector targets across Europe. CVE-2025-68461 presents a consistent attack surface: low-complexity delivery, no authentication required from the attacker's side, and high-value session data accessible upon execution.

For organizations in government, legal, healthcare, or finance sectors running Roundcube, this vulnerability enables email account compromise without brute force or credential theft. A single phishing email carrying a malicious SVG attachment is sufficient to initiate a full account takeover.

CISA has added CVE-2025-68461 to its Known Exploited Vulnerabilities catalog and mandated that all U.S. federal agencies apply the patch by March 13, 2026. Federal network defenders should treat that deadline as a ceiling, not a target.

Indicators to Review

SOC analysts should examine the following in email logs and web application firewalls:

  • Inbound emails carrying .svg attachments, particularly from external or unknown senders
  • SVG content embedded inline within email HTML body payloads
  • Webmail session anomalies such as concurrent logins from disparate IP addresses following SVG email delivery
  • Outbound HTTP requests from webmail servers to unknown external hosts, which may indicate data exfiltration via injected JavaScript

Patching and Mitigation

Primary action: Upgrade Roundcube Webmail to the vendor-released patched version immediately. Consult the Roundcube GitHub releases page for the current patched build and apply it to all instances.

Interim mitigations if patching cannot occur immediately:

  1. Disable SVG rendering in email previews. Configure Roundcube to block or strip SVG attachments before display. This directly removes the attack vector while a patch window is scheduled.

  2. Implement Content Security Policy (CSP) headers. A strict CSP that disallows inline scripts and restricts script sources to trusted domains reduces the exploitability of any residual XSS vectors across the application.

  3. Filter SVG attachments at the mail gateway. Deploy attachment filtering rules on your MTA or secure email gateway to quarantine or strip .svg files from inbound messages.

  4. Enable HttpOnly and Secure flags on session cookies. While this does not prevent XSS execution, it limits session cookie theft via document.cookie access.

  5. Audit Roundcube instances across your environment. Organizations with multiple deployments — including dev, staging, or departmental instances — must ensure all are patched, not just production.

System administrators running Roundcube on shared infrastructure should notify downstream users of the risk and apply patches before resuming normal operations.