This vulnerability in Roundcube Webmail involves improper neutralization of input during web page generation (CWE-79). Specifically, HTML attachments are not sufficiently sanitized when previewed, enabling XSS attacks. The affected versions are all releases prior to 1.5.14 and 1.6.14. Exploitation requires a victim to preview a malicious text/html attachment, which can lead to partial compromise of confidentiality and integrity within the webmail context. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and scope change.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser session with Roundcube Webmail, potentially exposing sensitive information or enabling actions on behalf of the user. The impact affects confidentiality and integrity but does not affect availability. No known exploits in the wild have been reported as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided and remediation level is not specified, users should monitor Roundcube's official channels for updates. Until a patch is available, users should exercise caution when previewing HTML attachments and consider disabling attachment preview functionality if feasible.