ftpfile in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users to execute arbitrary commands via shell metacharacters in a command line argument.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Vacation_plugin | Squirrelmail | * | 0.15 (including) |