This vulnerability in Roundcube Webmail before versions 1.6.18 and 1.7.3 involves improper neutralization of special elements (CWE-77) in the managesieve plugin. Specifically, improper quoting of rule names in Sieve scripts allows an attacker to bypass the managesieve_disabled_actions setting by crafting a malicious rule name. This could lead to unintended command execution or manipulation within the managesieve context. The vulnerability affects Roundcube Webmail versions 1.6.0 and 1.7.0 as explicitly stated. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact. No vendor advisory or patch information is currently provided, so patch status is not confirmed.

The vulnerability allows bypassing of the managesieve_disabled_actions setting via crafted rule names, potentially enabling unauthorized command execution or manipulation within the managesieve plugin context. This impacts the integrity of the affected system but does not affect confidentiality or availability. The attack requires network access and some privileges but no user interaction. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling the managesieve plugin if not required or restrict access to trusted users only. Monitor vendor communications for updates on patches or official mitigations.