Roundcube Webmail versions 1.6.14 through 1.6.16 and 1.7.0 contain a CWE-669 vulnerability where the remote image blocking feature fails to block images loaded from local or private network URLs. This incorrect resource transfer between security spheres can lead to unintended information disclosure or privilege escalation when a user views a maliciously crafted HTML email. The vulnerability is network exploitable without authentication or user interaction beyond viewing the email.

Successful exploitation may disclose sensitive information or escalate privileges within the affected Roundcube Webmail environment. The impact is limited to confidentiality and integrity, with no availability impact reported. The medium CVSS score reflects the network attack vector and lack of required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote image loading or applying email filtering to block suspicious HTML content referencing local/private URLs. Monitor vendor channels for updates and apply patches promptly once available.