CVE-2006-0195: Interpretation conflict in the MagicHTML filter in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to c...

Security readout for executives and security teams

This issue affects old SquirrelMail 1.4.0 through 1.4.5 webmail deployments. A specially crafted email or web content could bypass MagicHTML filtering and run script in a user's browser. The bundle does not provide a CVSS score, fixed version, or evidence of active exploitation. Exposure is most likely where SquirrelMail 1.4.0 to 1.4.5 remains reachable for users. Modern environments are less likely to be affected unless they still host legacy SquirrelMail or vendor-packaged builds from that era. Treat this as a legacy hygiene issue unless affected SquirrelMail is still exposed. If present, prioritize remediation because webmail XSS can affect user sessions and trust, but urgency is limited by missing severity and exploitation evidence. Mitigation focus: Inventory any SquirrelMail deployments and identify versions 1.4.0 through 1.4.5.; Check SquirrelMail and distribution advisories for the vendor-approved update path.; Prioritize retiring or replacing unsupported legacy SquirrelMail instances..

Prepared

Jun 29, 2026, 14:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.