Cyberwarzone

Roundcube CVE-2025-68461: SVG XSS Vulnerability Enables Silent Email Account Takeover Through Malicious Animate Tags

—

by

Elles De Yeager
in
Summarize with:



Roundcube Webmail, used by thousands of organizations worldwide for web-based email, contains a Cross-Site Scripting (XSS) vulnerability that lets attackers hijack accounts by sending a single malicious email.

The flaw—tracked as CVE-2025-68461 with a CVSS score of 7.2—exploits improper sanitization of SVG animation tags. When a victim opens the email, JavaScript executes in their browser session, giving the attacker full control over the account without requiring credentials.

Security patches have been released for Roundcube 1.5.12 and 1.6.12, but deployment lags. Poland’s CERT warns this is a dangerous vulnerability, and the Dutch NCSC emphasizes immediate patching. Previous Roundcube XSS flaws have been actively exploited.

The SVG Animate Tag Exploit

The vulnerability centers on Roundcube’s failure to neutralize the animate tag within SVG documents. SVG files, commonly used for scalable graphics, can contain animation instructions that manipulate visual elements over time.

Attackers weaponize the values attribute in an animate tag, which normally holds a semicolon-separated list of animation states. By embedding a javascript: URL as one value, the malicious script bypasses Roundcube’s HTML sanitizer.

A typical exploit looks like this: an SVG contains an anchor element linked to animation instructions. The keyTimes attribute forces the animation to jump immediately to the JavaScript payload and hold it indefinitely. When the email renders in the user’s browser, the script fires automatically.

CrowdStrike researchers first documented this technique. The attack requires no user interaction beyond opening the email. The script executes with the user’s session privileges, accessing cookies, tokens, and API endpoints. Attackers can read mail, exfiltrate contacts, send messages from the victim’s account, or pivot to other webmail features.

Why Email Clients Are High-Value Targets

Roundcube compromise doesn’t just expose one account—it creates operational cascades that defenders struggle to contain. Email is the authentication backbone for most enterprise systems. Once inside a mailbox, attackers reset passwords across platforms, intercept two-factor codes, and harvest institutional knowledge from archived threads.

Webmail clients like Roundcube are deployed by internet service providers, universities, hosting companies, and government agencies. A single vulnerable instance can affect thousands of end-users. Unlike desktop clients, webmail runs in the browser, making XSS particularly damaging because the attack surface includes session cookies, localStorage credentials, and any JavaScript-accessible data.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) underscores the risk: network-accessible, low complexity, no privileges required, no user interaction needed, and scope change to other components. This means an attacker can chain the XSS to exploit server-side features, internal plugins, or adjacent vulnerabilities like authentication bypasses seen in network appliances.

Roundcube has a history of XSS exploitation. Past campaigns targeted diplomatic and intelligence personnel. Security.nl reports multiple prior incidents where Roundcube flaws were weaponized in the wild. Organizations delaying patches effectively leave their email infrastructure open to credential harvesting and lateral movement.

Attack Mechanics and Detection

The exploit payload is small—often under 300 bytes. It embeds directly in an SVG file attached to or embedded within an email. The malicious code activates during HTML rendering, meaning server-side email scanners that only check for executable attachments may miss it entirely.

A common attack sequence begins with reconnaissance. The attacker identifies organizations running Roundcube (often detectable via HTTP headers or login page styling). They then craft a phishing email containing the SVG. The email subject and body may impersonate legitimate senders to increase open rates, but the XSS triggers regardless of social engineering success.

Once executed, the JavaScript reads document.cookie, capturing session tokens. These tokens authenticate API requests to Roundcube’s backend. Attackers use stolen credentials to:

  • Exfiltrate email archives via IMAP or webmail API
  • Forward all future mail to external addresses
  • Create filters that silently delete security alerts
  • Send phishing messages to the victim’s contact list

Detection requires reviewing webmail server logs for anomalous SVG file accesses. Version identification is straightforward—Roundcube displays its version in the UI footer or About section. Vulnerable versions are anything before 1.5.12 (LTS branch) or before 1.6.12 (stable branch). Network defenders should monitor for unusual JavaScript errors in browser consoles or unexpected API calls originating from webmail sessions.

Mitigation Beyond Patching

Applying Roundcube 1.5.12 or 1.6.12 fixes the immediate vulnerability, but defense-in-depth requires additional controls. The patched versions sanitize SVG animate tags, preventing malicious JavaScript injection. However, upgrade paths are not always straightforward—Roundcube is often bundled with hosting control panels or custom ISP platforms where updates require vendor coordination.

Organizations unable to patch immediately should implement a strict Content Security Policy (CSP) at the web server level. A CSP restricts script execution to trusted sources. A baseline directive like script-src ‘self’ blocks inline scripts, including those injected via XSS. For Roundcube installations that rely on inline scripts, start with CSP report-only mode, analyze violations, and refine the policy before enforcement.

Server-side SVG sanitization adds another layer. Tools like PHP’s svg-sanitizer library parse uploaded SVG files and remove dangerous elements (script tags, event handlers, javascript: URLs). A more aggressive approach rasterizes all SVG files to PNG format using ImageMagick, eliminating code execution risk entirely at the cost of losing vector scalability.

Email gateway filters should flag SVG attachments for inspection. Unlike PDF or Office documents, SVG files are rarely used in legitimate business communication. Organizations can implement allow-lists for known safe file types and quarantine everything else. Security teams should also review authentication logs for unexpected session activity following email opens, as this pattern indicates successful exploitation. Hardening measures like these reduce exposure even if patches lag, similar to attack surface reduction strategies in operating system security.

Sources and Further Reading

This analysis draws from multiple authoritative sources:

Organizations using Roundcube should verify their version immediately and prioritize updates. The vulnerability has been public since December 13, 2025, giving attackers three weeks to develop and test exploits before widespread awareness campaigns began.