This vulnerability in Roundcube Webmail involves improper validation of responses from the CSS proxy, leading to the possibility of cross-site scripting (CWE-79) or information disclosure through MIME sniffing. It affects Roundcube Webmail versions prior to 1.6.18 and 1.7.3. The CVSS 3.1 score is 7.2, indicating a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with scope changed.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure or manipulation of webmail content. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the current data. Users should monitor Roundcube's official channels for updates and apply patches once available.