This vulnerability in Roundcube Webmail before versions 1.6.18 and 1.7.3 arises from improper sanitization of the SVG animate "by" attribute in HTML/CSS content. This sanitization flaw allows attackers to bypass remote image blocking mechanisms, potentially enabling information disclosure or privilege escalation within the affected webmail application. The CVSS 3.1 base score is 5.8, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is tracked as CWE-669 (Incorrect Resource Transfer Between Spheres).

Successful exploitation could allow an attacker to bypass remote image blocking controls, which may lead to unauthorized information disclosure or escalation of privileges within the Roundcube Webmail environment. The impact is limited to confidentiality and privilege boundaries without affecting integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor Roundcube's official channels for updates and apply any forthcoming patches for versions prior to 1.6.18 and 1.7.3. Until a fix is available, consider restricting SVG content or disabling SVG animations if feasible.