This vulnerability in Roundcube Webmail arises from inadequate sanitization of HTML content, specifically related to SVG documents that include animate elements with the attributeName attribute. Attackers could exploit this flaw to inject CSS, leading to potential cross-site scripting attacks. Affected versions include 1.6.0 through versions before 1.6.16 and 1.7.0 before 1.7. The CVSS 3.1 score of 7.2 indicates a high-severity issue exploitable remotely without authentication or user interaction, with impacts on confidentiality and integrity due to scope change. No official patch or vendor advisory detailing remediation is currently available, and no exploits have been observed in the wild.

Successful exploitation could allow an attacker to inject malicious CSS via crafted SVG content, potentially leading to cross-site scripting attacks that compromise confidentiality and integrity of user data within the Roundcube Webmail interface. The vulnerability does not affect availability. The attack can be performed remotely without authentication or user interaction, increasing risk. However, no known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds recommended by the vendor or restrict SVG content handling if possible. Monitor official Roundcube channels for updates and apply patches promptly once available.