Roundcube Webmail versions prior to 1.6.16 and 1.7 contain insufficient HTML sanitization that allows attackers to inject CSS through an SVG document that contains an animate element with an attributeName attribute. This flaw can lead to cross‑site scripting or other style‑based attacks when a victim views or interacts with a maliciously crafted SVG, jeopardizing the confidentiality and integrity of user sessions. Based on the description, it is inferred that the attacker could trigger script execution.

The vulnerability affects the Roundcube Webmail product. Versions 1.6.x before 1.6.16 and 1.7.x before 1.7 are impacted.

The CVSS score of 7.2 indicates a high severity risk. No EPSS data is available, so the exploitation likelihood is uncertain, and the issue is not listed in the CISA KEV catalog. Since Roundcube processes user‑supplied HTML content, an attacker could potentially exploit this flaw via any authenticated or unauthenticated request that accepts HTML, such as composing emails, editing contact details, or attaching SVG files. The resulting CSS injection could execute JavaScript in the victim's browser, enabling credential theft or session hijacking. Based on the description, it is inferred that the attacker could trigger script execution.