CVE-2006-2842: Squirrelmail

High severity, CVSS 7.5. EPSS: 47.2% chance of exploitation in the next 30 days.

PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the plugins array parameter. NOTE: this issue has been disputed by third parties, who state that Squirrelmail provides prominent warnings to the administrator when register_globals is enabled. Since the varieties of administrator negligence are uncountable, perhaps this type of issue should not be included in CVE. However, the original developer has posted a security advisory, so there might be relevant real-world environments under which this vulnerability is applicable

Affected products

• Squirrelmail Squirrelmail: up to and including 1.4.6; version 1.0.4 only; version 1.0.5 only; version 1.2.0 only; version 1.2.1 only; version 1.2.2 only; …

Published 2006-06-06. Last modified 2026-06-16.