This vulnerability affects Roundcube Webmail versions prior to 1.6.16 and 1.7.1. The issue arises because the remote image blocking feature can be circumvented by embedding a specially crafted CSS var() value within an email message. This bypass may enable attackers to disclose information or bypass access controls that rely on remote image blocking. The CVSS 3.1 base score is 6.5, indicating a medium severity level. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation could lead to limited information disclosure or bypass of access controls related to remote image blocking in affected Roundcube Webmail versions. This could undermine privacy protections intended to prevent remote content from loading automatically in emails.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider additional email filtering or disabling remote content rendering where possible. Monitor official Roundcube channels for updates.