The SquirrelMail GPG plugin suffers from arbitrary file deletion and unsanitized javascript display vulnerabilities.