compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST request. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
PHP
Deserialization
Squirrelmail
NVD
CVSS 3.1
8.8
EPSS
1.4%