This vulnerability is a reflected cross‑site scripting flaw caused by insufficient sanitization of HTML attachments in the preview mode of Roundcube Webmail. When a user previews a text/html attachment, the unsanitized content can execute arbitrary JavaScript in the victim's browser. The attacker could inject scripts to steal session cookies, perform phishing, or deliver malware, compromising the confidentiality and integrity of the victim's session.

All installations of Roundcube Webmail using versions older than 1.5.14 or 1.6.14 are affected. This includes every deployment that has not yet upgraded to those or newer releases.

The CVSS score of 6.1 places this at medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires that a victim open or preview a malicious text/html attachment, which is a user‑initiated but easily induced activity. Because the exploit is client‑side, it can be triggered by any user who receives a malicious attachment, potentially leading to widespread phishing or credential theft.