CVE-2025-68460

HIGH
Published Dec 18, 2025 Modified Jan 2, 2026 CWE-116

Description

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.

Is your site exposed to CVE-2025-68460?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.2
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness Type (CWE)

CWE-116 CWE-116

Affected Products

Vendor Product
roundcube webmail
roundcube webmail

References

Frequently Asked Questions

What is CVE-2025-68460? +
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer. It has a CVSS v3.1 base score of 7.2 (HIGH).
How severe is CVE-2025-68460? +
CVE-2025-68460 has a CVSS v3.1 score of 7.2 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.
What products are affected by CVE-2025-68460? +
CVE-2025-68460 affects products from roundcube, specifically: webmail. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2025-68460? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-9348

Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view.
CVE-2026-58487

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, due to unsafe handling of the …
CVE-2025-1308

A vulnerability exists in PX Backup whereby sensitive information may be logged under specific conditions.
CVE-2025-1795

During an address list folding when a separating comma ends up on a folded line and that line is to …
CVE-2024-7873

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, CWE - …
CVE-2026-53693

A stored cross-site scripting vulnerability existed in MISP BSimVis tag rendering code. Several client-side rendering paths interpolated tag names, collection …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2025-68460 — free, no signup required.