This critical Cross-Site Scripting vulnerability in Roundcube Webmail is currently being exploited in the wild and requires immediate patching to prevent unauthorized code execution.

This is a Cross-Site Scripting (XSS) vulnerability caused by insufficient sanitization of the animate tag within SVG documents. An unauthenticated attacker can exploit this flaw by sending a specially crafted email containing an SVG attachment or inline image to execute arbitrary JavaScript in the context of the victim's session.

With a CVSS score of 9.5, this vulnerability represents a severe threat to organizational security. Successful exploitation allows attackers to hijack user sessions, steal sensitive credentials, or perform actions on behalf of the victim within the webmail interface. Given the ubiquity of email as a communication tool, this flaw poses a high risk of widespread data compromise and unauthorized access to internal systems.

Immediate Action: Upgrade Roundcube Webmail to version 1.5.12 or 1.6.12 immediately to incorporate the necessary security patches.

Proactive Monitoring: Review webmail access logs for unusual patterns or attempts to load external SVG resources that correlate with the exploitation of this vulnerability.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict content security policies to block malicious SVG uploads or filter out suspicious animate tags from incoming email traffic.

Public Exploit Available: Yes, public proof-of-concept repositories exist on GitHub.

Due to the critical severity and confirmed active exploitation of this vulnerability, organizations must prioritize the application of the vendor-provided patches. Failure to update the affected Roundcube instances leaves the environment exposed to session hijacking and potential further compromise of the internal network. Ensure all webmail servers are updated to the specified versions or newer as a matter of urgency.