CVE-2026-123620: Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion
Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authenticated Usermin users who can access the Read Mail module are exposed if they can create or otherwise cause an IMAP folder name containing shell metacharacters to be present. The resulting command execution runs as the affected user's system account.
What does an attacker need to exploit it?
The attacker needs valid Usermin authentication and a way to create a maliciously named IMAP folder, such as through an external IMAP client. They then trigger execution by deleting that folder through Usermin's Read Mail module.
Are webmail-only restrictions sufficient mitigation?
No. The issue can be triggered using a folder created through an external IMAP client and then deleted in Usermin, which bypasses webmail-only restrictions.