Roundcube Flaws Let Attackers Execute Malicious Scripts

Roundcube, a widely used open-source webmail platform, has released critical security updates to address two significant vulnerabilities in its 1.6 and 1.5 LTS versions, posing a risk to organizations and individuals who rely on the platform for email communication.

These vulnerabilities could allow attackers to execute malicious scripts or expose sensitive information, highlighting the importance of immediate action to secure the email environment.

On December 13, 2025, the maintainers of Roundcube Webmail published the security fixes, urging administrators to update their installations to the latest versions, 1.6.12 and 1.5.12, to prevent potential exploitation.

The new release versions specifically address the reported issues, ensuring the email environment is secure against potential threats.

The Vulnerabilities

A critical Cross-Site Scripting (XSS) vulnerability was discovered in how the software handles SVG images, specifically involving the animate tag, making it a significant concern for the security of the platform.

Another vulnerability, an Information Disclosure flaw, was found in the HTML style sanitizer, which is responsible for cleaning up HTML emails to prevent harmful code execution.

However, a bypass in this sanitizer could allow an attacker to reveal data that should remain hidden, potentially leading to further compromise of the system.

Although typically less severe than remote code execution, information disclosure can often be chained with other exploits to compromise a system further, emphasizing the need for prompt action.

The vulnerability was reported by a researcher known as “somerandomdev,” and the Roundcube team has strongly recommended that all productive installations running the 1.6.x and 1.5.x branches be updated immediately to the latest versions.

Administrators can find the complete changelogs and download files on the official Roundcube GitHub release pages, and it is essential to keep webmail clients patched, as they are often public-facing entry points into an organization’s internal network.

Failure to apply these patches could leave users vulnerable to targeted XSS attacks aimed at compromising email accounts and sensitive communications, making it crucial to prioritize the security updates.