ESET Research reported the vulnerability to the Roundcube team on October 12