Roundcube Webmail allows an attacker to circumvent the remote image blocking feature by embedding a specially crafted CSS var() expression in an e‑mail message. This flaw lets the attacker force the client to fetch external resources or reveal sensitive information, thereby potentially exposing content that should have been blockable or enabling an access‑control bypass in the status of the message. The vulnerability is a flow‑control issue (CWE‑669).

All installations of Roundcube Webmail running version 1.6 in the 1.6.x series before 1.6.16, and version 1.7 in the 1.7.x series before 1.7.1, are affected.

The vulnerability has a CVSS score of 6.5, indicating moderate severity. EPSS is not available, and it is not listed in the CISA KEV catalog, so the likelihood of widespread exploitation at this time is uncertain. The probable attack vector is a remote sender delivering a crafted e‑mail that contains the malicious CSS. Successful exploitation would enable the attacker to cause the victim’s client to load external resources, potentially revealing confidential content or bypassing intended access restrictions.