← Vulnerability feed

Vulnerability record · CVE-2007-3778 · published 15 July 2007

CVE-2007-3778: Squirrelmail gpg plugin vulnerability

Squirrelmail · Gpg Plugin

The G/PGP (GPG) Plugin 2.0, and 2.1dev before 20060912, for Squirrelmail allows remote attackers to execute arbitrary commands via shell metacharacters in the messageSignedText parameter to the gpg_check_sign_pgp_mime function in gpg_hook_functions.php. NOTE: a parameter value can be set in the contents of an e-mail message.

7.5 CVSS 2.0 High EPSS 2.7% · top 14.8%
7.5CVSS 2.0 base score
2.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
20References
16 Jun 2026Last modified by NVD

Description

The G/PGP (GPG) Plugin 2.0, and 2.1dev before 20060912, for Squirrelmail allows remote attackers to execute arbitrary commands via shell metacharacters in the messageSignedText parameter to the gpg_check_sign_pgp_mime function in gpg_hook_functions.php. NOTE: a parameter value can be set in the contents of an e-mail message.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=330 Patch
http://lists.immunitysec.com/pipermail/dailydave/2007-July/004452.html
http://lists.immunitysec.com/pipermail/dailydave/2007-July/004456.html
http://osvdb.org/37931
http://secunia.com/advisories/26035 Vendor Advisory
http://www.attrition.org/pipermail/vim/2007-July/001704.html
http://www.attrition.org/pipermail/vim/2007-July/001710.html
http://www.securityfocus.com/bid/24874
http://www.vupen.com/english/advisories/2007/2513
https://exchange.xforce.ibmcloud.com/vulnerabilities/35363
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=330 Patch
http://lists.immunitysec.com/pipermail/dailydave/2007-July/004452.html
http://lists.immunitysec.com/pipermail/dailydave/2007-July/004456.html
http://osvdb.org/37931
http://secunia.com/advisories/26035 Vendor Advisory
http://www.attrition.org/pipermail/vim/2007-July/001704.html
http://www.attrition.org/pipermail/vim/2007-July/001710.html
http://www.securityfocus.com/bid/24874
http://www.vupen.com/english/advisories/2007/2513
https://exchange.xforce.ibmcloud.com/vulnerabilities/35363

Track CVE-2007-3778 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2005-1924Squirrelmail gpg plugin vulnerabilityThe G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to execute arbitrary commands via shell metacharacters in (1…EPSS 10%7.5CVE-2007-3636Squirrelmail gpg plugin vulnerabilityMultiple unspecified vulnerabilities in the G/PGP (GPG) Plugin 2.1 for Squirrelmail allow remote attackers to execute arbitrary commands via unspecif…EPSS 3.1%6.5CVE-2007-3634Squirrelmail gpg plugin vulnerabilityUnspecified vulnerability in the G/PGP (GPG) Plugin 2.0 for Squirrelmail 1.4.10a allows remote authenticated users to execute arbitrary commands via …EPSS 1.6%5.5CVE-2006-4169Squirrelmail gpg plugin vulnerabilityMultiple directory traversal vulnerabilities in the G/PGP (GPG) Plugin 2.0, and 2.1dev before 20070614, for Squirrelmail allow remote authenticated u…EPSS 1.6%4.3CVE-2007-3779Squirrelmail gpg plugin vulnerabilityPHP local file inclusion vulnerability in gpg_pop_init.php in the G/PGP (GPG) Plugin before 20070707 for Squirrelmail allows remote attackers to incl…EPSS 1.2%4.3CVE-2007-3635Squirrelmail gpg plugin vulnerabilityMultiple unspecified vulnerabilities in the G/PGP (GPG) Plugin before 2.1 for Squirrelmail might allow "local authenticated users" to inject certain …EPSS 0.26%

Source: NIST National Vulnerability Database (record CVE-2007-3778), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.