Roundcube Webmail contains a bug that allows attackers to inject arbitrary Cascading Style Sheets through mishandled comments. The flaw can be used to alter the appearance of mail messages, overlay malicious content, or create phishing interfaces without needing to execute JavaScript. This is reflected in CWE‑79 (XSS) and CWE‑829 (permissions mismatch) and may compromise user interaction and trust in the webmail client.

Roundcube Webmail versions before 1.5.13 and before 1.6.13 deployed by Roundcube:Webmail are affected. The bug exists in all affected releases regardless of installation base and can impact any instance where user‑generated content is rendered.

The vulnerability has a CVSS score of 4.7, indicating moderate severity. The EPSS score is less than 1 %, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation activity to date. Attackers would likely need to inject malicious CSS into a user’s mailbox or a public page in the webmail interface, typically requiring the victim to view the crafted content. The availability of an easy remediation path reduces the overall risk for organizations that apply the update in a timely manner.