The vulnerability allows an attacker to embed carriage return and line feed sequences in the subject line of a forwarded message that is attached to an outgoing email. Roundcube uses the subject verbatim to form the attachment name without sanitizing newlines, thus the attacker can inject arbitrary MIME part headers into the forwarded email. This can compromise the integrity of outgoing mail and potentially allow spoofing or injection of unintended headers.

All installations of Roundcube Webmail earlier than version 1.6.20 or 1.7.x earlier than 1.7.5 are affected. These versions are listed by the vendor as vulnerable before the security releases 1.6.20 and 1.7.5.

The CVSS score of 4 indicates medium severity. The EPSS score of < 1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is remote via SMTP, requiring an attacker to send a crafted email to a user who forwards it as an attachment. While the exploitation likelihood is not explicitly quantified, the presence of a data injection flaw suggests that attackers with access to the mail system could potentially use it to alter outgoing messages.