This vulnerability affects Roundcube Webmail versions prior to 1.6.16 and 1.7.1. The remote image blocking feature, designed to prevent automatic loading of remote images in emails, can be circumvented by embedding a specially crafted CSS var() value within an email message. This flaw is classified under CWE-669 (Incorrect Resource Transfer Between Spheres), indicating improper handling of resource boundaries that can lead to unauthorized information flow or access control issues. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity but not availability.

Successful exploitation can lead to unauthorized disclosure of information or bypass of access controls in the affected Roundcube Webmail versions. This could allow an attacker to access content that should be blocked by the remote image blocking feature, potentially exposing sensitive information contained in emails. There is no indication of impact on system availability or integrity beyond access control and confidentiality concerns. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Roundcube's official channels for updates. Until a patch is available, consider disabling or restricting the use of the remote image blocking feature or applying additional email filtering to mitigate risk. Avoid relying solely on the remote image blocking feature for confidentiality protection.