Roundcube Webmail versions prior to 1.6.16 and 1.7.1 allow an attacker to inject malicious HTML or CSS into the "subject" field of an email draft that is later restored to a shared mailbox. The injected code is persisted in the mailbox view, and when any user opens the message they may execute arbitrary scripts within that browser context. This stored XSS has the potential to steal session cookies, deface the UI, or perform privileged actions on behalf of the victim. The flaw originates from a lack of proper sanitization (CWE‑79).

Roundcube Webmail 1.6.x releases before 1.6.16 and 1.7.x releases before 1.7.1. The vulnerability is limited to installations that permit shared mailboxes where draft messages can be stored and later retrieved by other users.

The CVSS score of 4.4 indicates moderate impact, but the lack of a publicly available EPSS score and absence from the KEV catalog suggest a limited exploitation probability under current conditions. Exploitation requires an attacker to create a malicious draft in a shared mailbox, which can be achieved by any authenticated user with write access to that mailbox. Once the draft is restored, the stored payload is delivered to all mailbox viewers, enabling widespread XSS across that shared environment.