The vulnerability arises when mail search functions and the LITERAL+ byte-count feature are not properly synchronized in Roundcube Webmail versions prior to 1.6.18 and 1.7.3. This desynchronization allows an attacker to inject arbitrary IMAP commands, which can lead to sensitive information disclosure or escalation of privileges on the mail server. The flaw is a classic command injection (CWE-77) that bypasses normal command restrictions.

Roundcube Webmail installations running any version before 1.6.18 or before 1.7.3 are affected. Customers should confirm that their deployment is using 1.6.18, 1.7.3, or later releases.

Based on the description, it is inferred that attackers would need the ability to send IMAP commands to the affected server, which could be achieved remotely if IMAP is exposed over the Internet. The CVSS score of 7.1 indicates high severity, and the EPSS score is 1%. The vulnerability is not listed in the CISA KEV catalog. Once the command injection is executed, the attacker may read protected mail or gain higher‑level access depending on the server’s configuration.