Roundcube webmail flaw exploited through SVG images: check your webmail version
A Roundcube flaw fixed in December 2025 was later confirmed exploited. Many hosts use Roundcube as webmail. Check that yours is current.
Affects:Roundcube before 1.6.12 / 1.5.12Webmail on many shared hosts
In December 2025, the Roundcube project released versions 1.6.12 and 1.5.12 to fix two security issues, including a cross-site scripting flaw triggered by the animate tag in an SVG image, now tracked as CVE-2025-68461 and reported by a CrowdStrike researcher. In plain terms, a specially crafted email could run code inside the reader's webmail session, which an attacker can use to act as that user.
On 20 February 2026, the US agency CISA added this flaw to its catalog of vulnerabilities exploited in the wild. The same day it added CVE-2025-49113, an older Roundcube flaw fixed in June 2025 in versions 1.6.11 and 1.5.10, which lets a logged-in user run code on the server.
Roundcube has published many security releases since. The latest on its news page, dated 19 October 2026, are 1.6.20 and 1.7.5. The last 1.5 release listed is 1.5.15, from March 2026.
Who is affected
Anyone whose webmail runs Roundcube before 1.5.12, or 1.6 before 1.6.12. Many hosts offer Roundcube as their webmail, so if you read your business email in a browser through your host, this may concern you. The server belongs to your host, so updating it is their job, unless you run your own VPS.
How to check your site
- Log in to your webmail. If the page shows the Roundcube logo or name, you use Roundcube.
- Open Settings and look for the "About" link. It shows the Roundcube version.
- Compare it with the versions above. Anything older than 1.6.12 is affected by this flaw, and anything older than 1.6.20 or 1.7.5 is missing later security fixes.
What to do now
- If your version is old, ask your host when Roundcube will be updated to the latest 1.6 or 1.7 release, and whether they saw unusual activity on your mailboxes.
- On your own VPS, update Roundcube to the latest release on roundcube.net, or through your panel's updates.
- Change your email password if you noticed messages you did not send, new forwarding rules, or settings you did not change.
- Until the update is confirmed, be careful with unexpected emails, especially ones carrying images from unknown senders.
Hosts usually update webmail with their regular system updates, so a server maintained since early 2026 is most likely protected, but the About page takes a minute to check. This alert reports what the sources listed below published and is not a guarantee about any specific site.