CVE-2006-2447: Apache Spamassassin

Medium severity, CVSS 5.1. EPSS: 75.8% chance of exploitation in the next 30 days.

SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username.

Affected products

• Apache Spamassassin: version 3.1.0 only; version 3.1.1 only; version 3.1.2 only

Published 2006-06-06. Last modified 2026-06-16.