CVE-2025-68460: Roundcube Webmail Info Disclosure Bug

CVE-2025-68460 Overview

CVE-2025-68460 is an information disclosure vulnerability affecting Roundcube Webmail versions before 1.5.12 and 1.6.x before 1.6.12. The vulnerability exists in the HTML style sanitizer component, which fails to properly validate and sanitize CSS style content. This flaw could allow attackers to bypass security controls and extract sensitive information from email content or user sessions.

Critical Impact

Attackers can exploit the HTML style sanitizer bypass to disclose sensitive information from Roundcube Webmail installations, potentially exposing email content, user data, or session information through maliciously crafted HTML emails.

Affected Products

• Roundcube Webmail versions before 1.5.12
• Roundcube Webmail versions 1.6.x before 1.6.12

Discovery Timeline

• 2025-12-13 - Roundcube releases security patches 1.6.12 and 1.5.12
• 2025-12-18 - CVE-2025-68460 published to NVD
• 2026-01-02 - Last updated in NVD database

Technical Details for CVE-2025-68460

Vulnerability Analysis

This vulnerability stems from improper output encoding in the HTML style sanitizer component (CWE-116). The sanitizer is designed to filter malicious content from HTML emails before rendering, but a flaw in the CSS parsing logic allows specially crafted style values to bypass validation. When processing CSS properties, the sanitizer failed to detect and block content containing semicolons followed by additional data, which could be used to inject malicious content or extract information.

The vulnerability is network-exploitable without requiring authentication or user interaction, making it particularly concerning for publicly accessible webmail deployments. An attacker could send a maliciously crafted email to a victim, and when the email is viewed in Roundcube, the sanitizer bypass could lead to information disclosure.

Root Cause

The root cause lies in the rcube_utils.php file's CSS style sanitization routine. The sanitizer processes CSS values but did not properly handle cases where a semicolon character appears within a value, followed by additional content. This improper encoding/escaping of output (CWE-116) allowed malicious payloads to slip through the sanitization process, enabling attackers to potentially access sensitive data through specially crafted style declarations.

Attack Vector

The attack vector is network-based, requiring an attacker to send a malicious email containing specially crafted HTML style attributes to a Roundcube user. When the victim opens the email in their webmail client, the vulnerability in the style sanitizer is triggered. The attack requires no authentication to execute and no user interaction beyond viewing the email, making it a practical vector for targeted attacks against Roundcube installations.

// Security patch from program/lib/Roundcube/rcube_utils.php
// Source: https://github.com/roundcube/roundcubemail/commit/08de250fba731b634bed188bbe18d2f6ef3c7571

                             $value .= ' url(' . $url . ')';
                         }
                     }
+                    } elseif (preg_match('/;.*/', $val)) {
+                        // Invalid or evil content, ignore
+                        continue;
                     } else {
                         // whitelist ?
                         $value .= ' ' . $val;

Source: GitHub Commit 08de250

Detection Methods for CVE-2025-68460

Indicators of Compromise

• Unusual CSS style patterns in received emails containing semicolons followed by additional content
• Email messages with abnormally complex or obfuscated inline style attributes
• Unexpected outbound requests originating from the Roundcube webmail server after email viewing
• Log entries showing style parsing errors or sanitization warnings in rcube_utils.php

Detection Strategies

• Monitor email content for CSS style values containing patterns matching /;.*/ which attempt to bypass sanitization
• Implement network-level inspection for emails with suspicious HTML style attributes targeting Roundcube installations
• Review Roundcube application logs for anomalous style processing behavior
• Deploy web application firewall rules to detect and block malformed CSS injection attempts in email content

Monitoring Recommendations

• Enable verbose logging in Roundcube to capture style sanitization activities
• Monitor for unusual HTTP requests that may indicate data exfiltration following email viewing
• Implement alerting on emails with unusually large or complex style attributes
• Regularly audit installed Roundcube version against known vulnerable versions

How to Mitigate CVE-2025-68460

Immediate Actions Required

• Upgrade Roundcube Webmail to version 1.5.12 or later for the 1.5.x branch
• Upgrade Roundcube Webmail to version 1.6.12 or later for the 1.6.x branch
• Review application logs for any evidence of exploitation attempts
• Consider temporarily disabling HTML email rendering if immediate patching is not possible

Patch Information

Roundcube has released security updates addressing this vulnerability. The fix adds validation to detect and reject CSS values containing semicolons followed by additional content, preventing the sanitizer bypass. Organizations should apply the patches immediately by upgrading to version 1.5.12 or 1.6.12 depending on their installed branch. The security fix is documented in commit 08de250fba731b634bed188bbe18d2f6ef3c7571.

For detailed patch information, see the Roundcube Security Update Announcement and the GitHub Commit Changes.

Workarounds

• Configure email client to display emails in plain text mode only until patching is complete
• Implement additional WAF rules to strip or sanitize potentially malicious CSS content from incoming emails
• Restrict access to Roundcube installations to trusted networks while awaiting patch deployment
• Consider using a reverse proxy with content filtering capabilities to inspect and sanitize HTML email content

# Configuration example - Update Roundcube to patched version
# Navigate to Roundcube installation directory
cd /var/www/roundcube

# Backup current installation
cp -r . ../roundcube_backup_$(date +%Y%m%d)

# Download and apply latest security update
# For version 1.6.x branch:
wget https://github.com/roundcube/roundcubemail/releases/download/1.6.12/roundcubemail-1.6.12-complete.tar.gz
tar -xzf roundcubemail-1.6.12-complete.tar.gz

# Verify installation and clear cache
./bin/update.sh
rm -rf temp/cache/*