Debian/roundcube: medium 6.1

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.

Action: Upgrade roundcube to 1.6.5+dfsg-1+deb12u6 or later.

Affected

Fixed versions

Sources

• osv: DEBIAN-CVE-2025-68461
• https://security-tracker.debian.org/tracker/CVE-2025-68461

published 2025-12-18T05:15:56.623Z · modified 2026-09-01T20:05:57.439631513Z · JSON