This vulnerability in Roundcube Webmail involves improper sanitization of the subject field when restoring drafts, leading to stored XSS/HTML/CSS injection in shared mailboxes. A malicious actor with low privileges can craft a subject that, when restored by a user, executes injected code in the victim's browser. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high complexity, low privileges required, and user interaction needed. The vulnerability affects versions 1.6.0 through 1.6.15 and 1.7.0, with no official fix or patch currently documented.

Successful exploitation could allow an attacker to execute arbitrary script code in the context of the victim's browser when accessing shared mailboxes, potentially leading to information disclosure or session manipulation. The impact is limited to confidentiality and integrity with no availability impact. The attack requires user interaction and has high complexity, reducing the likelihood of widespread exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when restoring drafts from shared mailboxes and consider restricting access to shared mailboxes to trusted users only. Monitoring for suspicious activity related to draft restoration may help detect exploitation attempts.