A stored cross-site scripting (XSS) vulnerability exists in Roundcube Webmail prior to versions 1.6.17 and 1.7.2. The vulnerability arises from improper escaping of the attachment MIME type on the attachment-validation warning page, which can lead to script injection that persists and executes when the page is viewed. This issue affects multiple specific Ubuntu package versions of Roundcube as listed, and the vulnerability allows an attacker to execute arbitrary scripts in the context of the affected webmail interface.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser session when viewing the attachment-validation warning page. This may lead to information disclosure or user interface manipulation. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, and a scope change with low confidentiality and integrity impact and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor for official updates from Roundcube or their Linux distribution maintainers and apply patches once available. Until patched, cautious handling of attachments and limiting user interaction with untrusted content may reduce risk.