This vulnerability in Roundcube Webmail 1.6.0 (before 1.6.14) arises from inadequate sanitization of CSS content in HTML emails. Maliciously crafted stylesheet links can point to internal network resources, potentially enabling SSRF or disclosure of sensitive information. The CVSS 3.1 base score is 5.4, reflecting network attack vector with high attack complexity, no privileges required, no user interaction, and partial confidentiality and integrity impact. No vendor advisory or patch details are provided, and the product is not a cloud service.

Successful exploitation could lead to SSRF or information disclosure by leveraging malicious CSS stylesheet links in HTML emails. This could expose internal network resources or sensitive information accessible to the Roundcube Webmail server. The impact is limited to confidentiality and integrity with no availability impact. There are no known active exploits currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting or sanitizing HTML email content or disabling remote stylesheet loading if possible. Monitor vendor communications for updates on patches or official mitigations.