CVE-2026-54432 is a stored XSS vulnerability in Roundcube Webmail affecting versions prior to 1.6.17 and 1.7.2. The vulnerability arises because the attachment MIME type is not properly escaped when displayed on the attachment-validation warning page, enabling an attacker to inject and store malicious scripts that execute when a user views the affected page.

An attacker could exploit this vulnerability to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure or session hijacking. The CVSS score of 4.7 indicates a medium severity with low impact on confidentiality and integrity, no impact on availability, and requiring network attack vector with high attack complexity and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to Roundcube Webmail version 1.6.17 or later, or 1.7.2 or later, once official fixes are released. Until then, exercise caution when handling attachments and consider additional input validation or filtering on the MIME type display if possible.