diff -Nru sogo-5.12.1/debian/changelog sogo-5.12.1/debian/changelog
--- sogo-5.12.1/debian/changelog	2025-07-25 11:26:33.000000000 +0200
+++ sogo-5.12.1/debian/changelog	2025-12-24 13:43:41.000000000 +0100
@@ -1,3 +1,11 @@
+sogo (5.12.1-3+deb13u1) trixie-UNRELEASED; urgency=high
+
+  * Non-maintainer upload by the Security Team.
+  * CVE-2025-63498 - Cross Site Scripting (XSS)
+  * CVE-2025-63499 - Cross Site Scripting (XSS) (Closes: #1121952)
+
+ -- Tobias Frost <tobi@debian.org>  Wed, 24 Dec 2025 13:43:41 +0100
+
 sogo (5.12.1-3) unstable; urgency=medium
 
   * Add upstream patch to fix freebusy calculation.
diff -Nru sogo-5.12.1/debian/patches/CVE-2025-63498.patch sogo-5.12.1/debian/patches/CVE-2025-63498.patch
--- sogo-5.12.1/debian/patches/CVE-2025-63498.patch	1970-01-01 01:00:00.000000000 +0100
+++ sogo-5.12.1/debian/patches/CVE-2025-63498.patch	2025-12-24 13:43:41.000000000 +0100
@@ -0,0 +1,54 @@
+Description: CVE-2025-63498 - Cross Site Scripting (XSS) via the "userName" parameter
+Origin: https://github.com/Alinto/sogo/commit/9e20190fad1a437f7e1307f0adcfe19a8d45184c
+Bug: https://github.com/xryptoh/CVE-2025-63498
+
+From 9e20190fad1a437f7e1307f0adcfe19a8d45184c Mon Sep 17 00:00:00 2001
+From: Hivert Quentin <quentin.hivert.fr@gmail.com>
+Date: Thu, 2 Oct 2025 13:37:56 +0200
+Subject: [PATCH] fix(login): Only remember the login if the auth was
+ successful
+
+---
+ UI/MainUI/SOGoRootPage.m | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/UI/MainUI/SOGoRootPage.m b/UI/MainUI/SOGoRootPage.m
+index f3d54dd6fb..79533e42d1 100644
+--- a/UI/MainUI/SOGoRootPage.m
++++ b/UI/MainUI/SOGoRootPage.m
+@@ -274,7 +274,7 @@ - (WOResponse *) connectAction
+ 
+   SOGoPasswordPolicyError err;
+   int expire, grace;
+-  BOOL rememberLogin, b;
++  BOOL rememberLogin, b, loginSuccess;
+ 
+   err = PolicyNoError;
+   expire = grace = -1;
+@@ -296,12 +296,14 @@ - (WOResponse *) connectAction
+ 		 perr: &err expire: &expire grace: &grace additionalInfo: &additionalLoginInformations useCache: NO];
+   [self translateAdditionalLoginInformations: &additionalLoginInformations];
+ 
+-  if (b
++  loginSuccess = b
+       && (err == PolicyNoError)
+       // no password policy
+       && ((expire < 0 && grace < 0)     // no password policy or everything is alright
+       || (expire < 0 && grace > 0)      // password expired, grace still permits login
+-      || (expire >= 0 && grace == -1))) // password about to expire OR ppolicy activated and passwd never changed
++      || (expire >= 0 && grace == -1)); // password about to expire OR ppolicy activated and passwd never changed
++
++  if (loginSuccess) 
+     {
+       NSMutableDictionary *json = [NSMutableDictionary dictionary];
+ 
+@@ -442,7 +444,8 @@ - (WOResponse *) connectAction
+       response = [self _responseWithLDAPPolicyError: err additionalInfos: additionalLoginInformations];
+     }
+ 
+-  if (rememberLogin)
++  //Only remember login If the auth was succesful...
++  if (rememberLogin && loginSuccess)
+     [response addCookie: [self _cookieWithUsername: [params objectForKey: @"userName"]]];
+   else
+     [response addCookie: [self _cookieWithUsername: nil]];
diff -Nru sogo-5.12.1/debian/patches/CVE-2025-63499.patch sogo-5.12.1/debian/patches/CVE-2025-63499.patch
--- sogo-5.12.1/debian/patches/CVE-2025-63499.patch	1970-01-01 01:00:00.000000000 +0100
+++ sogo-5.12.1/debian/patches/CVE-2025-63499.patch	2025-12-24 13:40:41.000000000 +0100
@@ -0,0 +1,40 @@
+Description: CVE-2025-63499 - Reflected XSS Vulnerability
+Origin: https://github.com/Alinto/sogo/commit/16ab99e7cf8db2c30b211f0d5e338d7f9e3a9efb
+Bug: https://github.com/poblaguev-tot/CVE-2025-63499
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1121952
+
+From 16ab99e7cf8db2c30b211f0d5e338d7f9e3a9efb Mon Sep 17 00:00:00 2001
+From: Hivert Quentin <quentin.hivert.fr@gmail.com>
+Date: Wed, 26 Nov 2025 13:22:38 +0100
+Subject: [PATCH] fix(vulnerability): prevent sogo to execute scripts pass in
+ theme query
+
+---
+ UI/SOGoUI/UIxComponent.m | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/UI/SOGoUI/UIxComponent.m b/UI/SOGoUI/UIxComponent.m
+index a8658e772b..012d6edea7 100644
+--- a/UI/SOGoUI/UIxComponent.m
++++ b/UI/SOGoUI/UIxComponent.m
+@@ -395,14 +395,18 @@ - (NSString *) ownPath
+ 
+ - (NSString *) relativePathToUserFolderSubPath: (NSString *) _sub
+ {
+-  NSString *dst, *rel, *theme;
++  NSString *dst, *rel, *theme, *safeTheme;
+ 
+   dst = [[self userFolderPath] stringByAppendingPathComponent: _sub];
+   rel = [dst urlPathRelativeToPath:[self ownPath]];
+ 
+   theme = [[context request] formValueForKey: @"theme"];
+   if ([theme length])
+-    rel = [NSString stringWithFormat: @"%@?theme=%@", rel, theme];
++  {
++    safeTheme = [theme stringWithoutHTMLInjection: YES];
++    if([safeTheme isEqualToString: theme])
++      rel = [NSString stringWithFormat: @"%@?theme=%@", rel, theme];
++  }
+ 
+   return rel;
+ }
diff -Nru sogo-5.12.1/debian/patches/series sogo-5.12.1/debian/patches/series
--- sogo-5.12.1/debian/patches/series	2025-07-25 11:24:14.000000000 +0200
+++ sogo-5.12.1/debian/patches/series	2025-12-24 13:43:41.000000000 +0100
@@ -15,3 +15,5 @@
 upstream_password_regex.patch
 upstream_fix_evaluation_freebusy.patch
 upstream_use_openid_libcurl.patch
+CVE-2025-63499.patch
+CVE-2025-63498.patch