What is CVE-2006-2842?

CVE-2006-2842 is a vulnerability in Squirrelmail. Published 2006-06-06.

Is CVE-2006-2842 known to be exploited?

7 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Squirrelmail

CVE-2006-2842

PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the plugins array parameter. NOTE: this issue has been disputed by third parties, who state that Squirrelmail provides prominent warnings to the administrator when register_globals is enabled. Since the varieties of administrator negligence are uncountable, perhaps this type of issue should not be included in CVE. However, the original developer has posted a security advisory, so there might be relevant real-world environments under which this vulnerability is applicable

Published 2006-06-06 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.440 (98.7th percentile), scored 2026-09-29.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 99th percentile — 98.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.472 · newest: 0.440 · change: -0.032

Affected products

Squirrelmail — versions 1.0.4, 1.0.5, 1.2.0

Public proof-of-concept exploits

References

www.novell.com/linux/security/advisories/2006_17_sr.html (vendor-advisory)
www.vupen.com/english/advisories/2007/2732 (vdb-entry)
www.securityfocus.com/bid/18231 (Exploit, vdb-entry)
lists.apple.com/archives/security-announce//2007/Jul/msg00004.html (vendor-advisory)
squirrelmail.cvs.sourceforge.net/squirrelmail/squirrelmail/functions/global.php (Patch)
www.securityfocus.com/archive/1/435605/100/0/threaded (mailing-list)
secunia.com/advisories/21262 (third-party-advisory)
www.redhat.com/support/errata/RHSA-2006-0547.html (vendor-advisory)
secunia.com/advisories/20406 (Patch, Vendor Advisory, third-party-advisory)
securitytracker.com/id (vdb-entry)

Frequently asked questions

What is CVE-2006-2842?: CVE-2006-2842 is a vulnerability in Squirrelmail. Published 2006-06-06.
Is CVE-2006-2842 known to be exploited?: 7 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.