Roundcube Webmail is vulnerable to a content blocking bypass that allows attackers to embed CSS escape sequences in FuncIRI attributes. Because the URL token pattern was limited to a few escaped forms, values such as \000075rl( or u\72 l( were not detected as safe URLs. An attacker can craft an HTML e‑mail that uses these escapes to load remote content without the user’s knowledge. The vulnerability does not give direct code execution but enables the loading and potential display of malicious content, which can be used for phishing, credential harvesting, or further attacks.

The issue affects Roundcube Webmail versions earlier than 1.6.20 and 1.7.x versions earlier than 1.7.5. These versions are listed under the Roundcube:Webmail product line.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score is not available; the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector involves an attacker sending a specially crafted e‑mail containing CSS escape sequences to a user. When the user opens the message in Roundcube Webmail, the remote content loads without consent. Since the exploit requires only crafted email content and does not need additional privileges, it is considered easy to trigger for a target user.