Roundcube Webmail versions 1.6.0 and 1.7.0 contain insecure code evaluation logic in the LDAP autovalues option, classified under CWE-670 (Always-Incorrect Control Flow Implementation). This flaw could lead to code injection attacks. The vulnerability is mitigated by removing code evaluation support in later versions (1.6.16 and 1.7.1). The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

Successful exploitation could allow an attacker to inject and execute arbitrary code within the Roundcube Webmail environment, potentially compromising confidentiality, integrity, and availability of the system. The vulnerability affects user data and system operations due to code injection via LDAP autovalues. No known exploits in the wild have been reported.

A fix is available by upgrading to Roundcube Webmail version 1.6.16 or 1.7.1 or later, where support for code evaluation in the LDAP autovalues option has been removed. Since no official vendor advisory or patch link is provided, users should verify upgrade availability from official Roundcube sources. Patch status is not yet confirmed in the provided data — check the vendor advisory for current remediation guidance.