Roundcube Webmail had two vulnerabilities confirmed exploited and added to CISA's KEV catalogue on the same day, 20 February 2026 — a near-maximum-severity deserialization bug that allows remote code execution by any authenticated user, and a high-severity cross-site scripting flaw exploitable via a crafted SVG attachment.
| CVE | CVSS | Flaw | Added to KEV |
|---|---|---|---|
| CVE-2025-49113 | 9.9 | PHP object deserialization via unvalidated _from parameter | 20 Feb 2026 |
| CVE-2025-68461 | 7.2 | Stored XSS via SVG animate tag | 20 Feb 2026 |
Why a low-privilege bug and a near-maximum-severity bug landing together is the real story
At first glance these two CVEs look like they belong in different tiers of urgency — a 9.9 versus a 7.2 — but CISA added them to the KEV catalogue on the exact same date, meaning both were independently confirmed as actively exploited at the same moment against the same product. That timing is the point: an attacker chain against Roundcube doesn't need to pick one bug over the other. CVE-2025-68461's stored XSS via an SVG animate tag is a classic foothold vector — get a malicious SVG in front of a victim's inbox, and script executes in their authenticated session. CVE-2025-49113 is what a foothold like that gets escalated into: the _from parameter in a URL going to program/actions/settings/upload.php isn't validated, and that lack of validation leads directly to PHP Object Deserialization, NVD's own language for the bug. Deserialization vulnerabilities of this kind are reliably among the most dangerous bug classes in web applications because unpickling attacker-controlled data into live PHP objects routinely gives an attacker a path to arbitrary code execution on the server itself, not just script execution in a browser tab.
The CVSS vector for CVE-2025-49113 requires low privileges (PR:L) — meaning an attacker needs some authenticated foothold in Roundcube first, which is exactly what an XSS bug like CVE-2025-68461 is capable of supplying. Two vulnerabilities that individually look like "moderate XSS" and "needs existing access" combine into an unauthenticated-to-RCE chain when read together, which is the scenario CISA's same-day KEV addition should prompt defenders to actually model rather than treating each CVE as an independent, isolated risk to be triaged on its own severity score alone.
Webmail's structural exposure to both bug classes
Roundcube, like most webmail platforms, exists specifically to render attacker-supplied content — HTML email bodies, image and SVG attachments, file uploads through settings pages — to authenticated users as a core product function, not an edge case. SVG in particular has a long history as an XSS vector across web applications generally because it's a legitimate, commonly allowed image format that also happens to support embedded scripting constructs like the animate tag exploited here, making blanket file-type allowlisting an insufficient control on its own. The upload.php code path targeted by CVE-2025-49113 exists to let users manage settings and presumably profile-related uploads, and the parameter-validation gap that led to deserialization is the kind of defect that's easy to introduce in any endpoint accepting file-adjacent parameters from the URL without server-side type checking on what gets unserialized.
Both fixes shipped in the same release cycle — Roundcube's 1.6.11/1.5.10 patch closed the deserialization bug, and 1.6.12/1.5.12 closed the SVG XSS bug roughly six months later — which tells its own story about the cadence at which this specific webmail platform has needed security attention over the past year.
What to check this week
Upgrade to Roundcube 1.6.12 or 1.5.12 or later, which is the version line that resolves both vulnerabilities; an install patched only against CVE-2025-49113 remains exposed to the SVG XSS foothold vector.
Treat any Roundcube instance still on a version predating June 2025's 1.6.11/1.5.10 release as a near-maximum-severity exposure, given CVE-2025-49113's 9.9 score and its path to remote code execution for any authenticated user.
Review SVG handling in attachment and avatar upload paths specifically, since the animate tag technique behind CVE-2025-68461 is a known SVG-XSS pattern that can recur in other upload surfaces if SVG sanitization isn't applied consistently platform-wide.
Audit authenticated session activity on internet-facing Roundcube deployments for the period between the two disclosure dates, since the combination of an XSS foothold and a deserialization RCE gives attackers who found either bug independently a realistic path to full compromise.
A final consideration on webmail as a soft entry point
Webmail platforms sit at an unusual intersection: internet-facing by design, authenticated by design, and processing untrusted content by design — a combination that makes them a persistently attractive initial-access target regardless of how mature the underlying codebase is. Two confirmed-exploited CVEs landing on the same day against the same product is a reminder that webmail deserves the same internet-facing patch discipline typically reserved for VPN concentrators and firewalls, not a lighter one just because it's "just email."
How Safeguard helps
Safeguard's continuous inventory flags internet-facing webmail platforms like Roundcube for accelerated patch review, and surfaces same-day KEV clusters like this one so that a low-severity XSS finding isn't triaged in isolation from the near-maximum-severity bug that landed alongside it.
