Roundcube Webmail versions 1.6.14 to 1.6.16 and 1.7.0 contain a vulnerability where the remote image blocking feature fails to block image URLs that point to local or private network destinations. This failure can allow an attacker to bypass intended restrictions, potentially causing information disclosure or privilege escalation via specially crafted HTML email messages. The issue is categorized as CWE-669, which involves incorrect resource transfer between security domains. The CVSS 3.1 base score is 6.5, indicating a medium severity vulnerability with network attack vector, low complexity, no privileges required, and no user interaction needed. No official fix or patch has been documented yet, and no exploits have been observed in the wild.

The vulnerability may allow attackers to bypass remote image blocking controls in Roundcube Webmail, leading to possible information disclosure or privilege escalation. This could compromise user data confidentiality or elevate attacker privileges within the affected system. However, no known active exploitation has been reported, and the impact is limited to the affected versions of Roundcube Webmail.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users and administrators should monitor vendor communications for updates. Until a patch is available, consider applying temporary mitigations such as disabling HTML email rendering or remote image loading in Roundcube Webmail settings if feasible.