This vulnerability in Roundcube Webmail involves improper neutralization of input during web page generation (CWE-79). Specifically, in versions prior to 1.6.18 and 1.7.3, the CSS proxy responses were not validated, which can lead to cross-site scripting or information disclosure through MIME sniffing. The CVSS 3.1 score is 7.2, indicating a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with no availability impact.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure or manipulation of webmail content. This could compromise user confidentiality and integrity of the webmail session. There is no known exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor Roundcube's official channels for updates and apply patches once available. Until then, consider applying any recommended temporary mitigations from the vendor if provided.