Open Webmail does verify sessionid input correctly, this could lead to privilege escalation or system access.

It is however required that the malicious person is able to place two files on the system. This could be done by local users, via anonymous ftp or another vulnerability.

The problem is that Open Webmail runs as root and does not strip '../' from sessionids, this allows a malicious person to include arbitrary files, by including af specially crafted file arbitrary commands could be executed with root privileges.

Solution
Patch:
Further details available to Secunia VIM customers

Provided and/or discovered by
Dmitry Guyvoronsky

Deep Links
Links available to Secunia VIM customers