The vulnerability originates from insufficient CSS sanitization in the rendering of HTML e‑mail messages. When an attacker crafts an email containing malicious <link> or style tags that point to internal network hosts, the client may fetch the resource, exposing internal addresses or allowing the attacker to verify their existence. This can lead to Server Side Request Forgery or inadvertent disclosure of local network resources.

Roundcube Webmail versions that precede 1.6.14, specifically 1.6.0 through 1.6.13, are affected. The release 1.6.14 and later, as well as the 1.7‑rc5 release, contain the fix that properly sanitizes or blocks external stylesheets.

The CVSS score of 5.4 classifies the issue as medium severity. No EPSS data is provided, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a lower exploitation probability. The attack requires the victim to open a crafted email or have the mail client fetch external stylesheets, indicating a user‑interaction or local‑host based vector rather than a purely remote exploit.