Back Linuxsecurity

Ubuntu 26.04 LTS Roundcube Important XSS Risk USN-8482

Linuxsecurity •LinuxSecurity Advisories • June 30, 2026

Roundcube Webmail could be made to run programs as your login if it opened a malicious website. Software Description: - roundcube: skinnable AJAX based webmail solution for IMAP servers - metapack Details: It was discovered that Roundcube Webmail was prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document. An attacker could use this issue to execute arbitrary web script in the context of an affected user's session.

Roundcube Webmail could be made to run programs as your login if it opened

Software Description:

- roundcube: skinnable AJAX based webmail solution for IMAP servers - metapack

It was discovered that Roundcube Webmail was prone to a Cross-Site-Scripting

(XSS) vulnerability via the animate tag in an SVG document. An attacker

could use this issue to execute arbitrary web script in the context of an

affected user's session.

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS roundcube 1.6.11+dfsg-1ubuntu0.26.04.1~esm1 Available with Ubuntu Pro roundcube-core 1.6.11+dfsg-1ubuntu0.26.04.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

Ubuntu Security Notice USN-8482-1

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical XSS Vulnerability in Roundcube Webmail Discovered A Cross-Site-Scripting (XSS) vulnerability has been identified in Roundcube Webmail, allowing attackers to execute arbitrary scripts in the context of a user's session if they visit a malicious website. The vulnerability is linked to the animate tag in SVG documents. This issue affects users of Roundcube Webmail, which is widely used for IMAP servers. Users are advised to update their systems to the latest package versions to mitigate the risk. The vulnerability has been assigned the identifier USN-8482-1. Ubuntu Pro users are provided with ten-year security coverage for affected packages. A standard system update is recommended to apply the necessary changes. The vulnerability poses a significant risk if exploited, as it could lead to unauthorized actions under the user's account. 2 sources 71

Extracted Entities

Ubuntu 26.04 LTS Roundcube Important XSS Risk USN-8482

The full story

Extracted Entities

Companies (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)