CVE-2006-0377: Squirrelmail

Medium severity, CVSS 5.0. EPSS: 2.4% chance of exploitation in the next 30 days.

CRLF injection vulnerability in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary IMAP commands via newline characters in the mailbox parameter of the sqimap_mailbox_select command, aka "IMAP injection."

Affected products

• Squirrelmail Squirrelmail: version 1.4 only; version 1.4.1 only; version 1.4.2 only; version 1.4.3 only; version 1.4.3_r3 only; version 1.4.3_rc1 only; …

Published 2006-02-24. Last modified 2026-06-16.