Description
Cross-site scripting (XSS) vulnerability in read_body.php for SquirrelMail 1.2.10, 1.2.9, and earlier allows remote attackers to insert script and HTML via the (1) mailbox and (2) passed_id parameters.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | squirrelmail | 1.2.6-1.3 | DSA-220 |
Advisories 1
- DSA-220 squirrelmail - cross site scripting Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20021215 GLSA: squirrelmail mailing-list
- squirrelmail-readbody-xss(10754) vdb-entry
- 6302 vdb-entry
- 20021203 SquirrelMail v1.2.9 XSS bugs mailing-list
- 20021203 Re: SquirrelMail v1.2.9 XSS bugs mailing-list
- DSA-220 vendor-advisory
- 8220 third-party-advisory
- http://f0kp.iplus.ru/bz/008.txt
- RHSA-2003:042 vendor-advisory