This vulnerability in Roundcube Webmail allows an attacker to inject malicious scripts via the subject field of draft emails that are restored in shared mailboxes. Because the input is not properly neutralized, it can lead to stored XSS attacks affecting users who access the shared mailbox. The affected versions are 1.6.0 through before 1.6.16 and 1.7.0 before 1.7.1. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, user interaction required, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser when accessing the shared mailbox, potentially leading to information disclosure or session manipulation. The impact is limited to confidentiality and integrity with no direct availability impact. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when accessing shared mailboxes and avoid restoring drafts from untrusted sources. Monitor vendor communications for updates on patches or official mitigations.