This CVE is a stored XSS in Roundcube's 'Add to address book' feature—specifically, the mechanism that copies a sender's name and email from an email header into persistent contact storage. Email content is correctly sanitized when rendered in the message view, but Roundcube appears to treat data flowing into the address book as a lower-trust operation, even though those entries render in the same privileged UI contexts: compose tooltips, notification previews, and autocomplete dropdowns. No user interaction is required to trigger the malicious payload once it's stored.
The CVSS 5.4 rating underweights this vulnerability. The blast radius is significant because the address book is an authenticated high-trust surface—attackers who populate it gain persistence inside a context where users have lowered their guard, and the contact graph (names, emails, often organizational affiliations) is directly exfiltrable. If Roundcube exposes the address book via API, plugin, or mobile sync, the impact extends beyond the web UI.
This is the third or fourth similar XSS in Roundcube's peripheral features over recent years—signature handling and contact imports have suffered the same flaw. The pattern is consistent: untrusted input from email content flows into storage paths that bypass the primary sanitization pipeline used for message rendering. This isn't bad luck; it's evidence that features handling data transfer between contexts (email → address book, email → signature, import → contact) lack automated sanitization enforcement at the framework level.
What to check: audit any feature that persists data derived from email content, particularly around contact management and signature rendering. Look for storage paths that don't pass through the same sanitization chain as the core email view. Prioritize remediation not by CVE score but by whether the affected feature renders in auto-displayed contexts—the lower the user interaction requirement, the higher the real-world impact.