CVE-2026-2469
ImapEngine affected by command injection via the ID command parameters
Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands. This allows attackers to read or delete victim's emails, terminate the victim's session or execute any valid IMAP command on victim's mailbox by including quote characters " or CRLF sequences \r\n in the input.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands. This allows attackers to read or delete victim's emails, terminate the victim's session or execute any valid IMAP command on victim's mailbox by including quote characters " or CRLF sequences \r\n in the input.
- Record
CVE-2026-2469- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H/E:P - Weakness
- CWE-74
- Updated
- 2026-11-02
EUVDEUVD-2026-6070
Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands. This allows attackers to read or delete victim's emails, terminate the victim's session or execute any valid IMAP command on victim's mailbox by including quote characters " or CRLF sequences \r\n in the input.
- Record
EUVD-2026-6070- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rfq9-4wcm-64gh
ImapEngine affected by command injection via the ID command parameters
Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands. This allows attackers to read or delete victim's emails, terminate the victim's session or execute any valid IMAP command on victim's mailbox by including quote characters " or CRLF sequences \r\n in the input.
- Record
GHSA-rfq9-4wcm-64gh- CVSS 4.0
- 5.7 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
NVD
Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands. This allows attackers to read or delete victim's emails, terminate the victim's session or execute any valid IMAP command on victim's mailbox by including quote characters " or CRLF sequences \r\n in the input.
- Record
CVE-2026-2469- CVSS 4.0
- 5.7 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
OSV
Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands. This allows attackers to read or delete victim's emails, terminate the victim's session or execute any valid IMAP command on victim's mailbox by including quote characters " or CRLF sequences \r\n in the input.
- Record
CVE-2026-2469- CVSS 4.0
- 5.7 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-74
- Updated
- 2026-11-11
OSVGHSA-rfq9-4wcm-64gh
ImapEngine affected by command injection via the ID command parameters
Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands. This allows attackers to read or delete victim's emails, terminate the victim's session or execute any valid IMAP command on victim's mailbox by including quote characters " or CRLF sequences \r\n in the input.
- Record
GHSA-rfq9-4wcm-64gh- CVSS 4.0
- 5.7 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
directorytree/imapenginePackagist | before 1.22.3 | 1.22.3 |
directorytree/imapenginePackagist | before 1.22.3, plus listed versions v1.0.0v1.0.1v1.0.2v1.0.3v1.0.4 Show 45 moreShow lessv1.0.5v1.1.0v1.10.0v1.10.1v1.11.0v1.11.1v1.11.2v1.12.0v1.12.1v1.13.0v1.13.1v1.13.2v1.13.3v1.13.4v1.13.5v1.13.6v1.13.7v1.13.8v1.14.0v1.15.0v1.15.1v1.15.2v1.15.3v1.15.4v1.15.5v1.16.0v1.16.1v1.16.2v1.17.0v1.17.1v1.17.2v1.17.3v1.18.0v1.18.1v1.18.2v1.18.3v1.18.4v1.18.5v1.18.6v1.19.0v1.19.1v1.19.2v1.2.0v1.2.1v1.2.2 | 1.22.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-2469 is a high vulnerability (CVSS 7.2) in directorytree/imapengine, published February 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in directorytree/imapengine 1.22.3.
References
security.snyk.io/vuln/SNYK-PHP-DIRECTORYTREEIMAPENGINE-15274300
github.com/DirectoryTree/ImapEngine/pull/150
gist.github.com/wanamirulhakim/74b41589cdea3c07c3375e5946960778
nvd.nist.gov/vuln/detail/CVE-2026-2469
Left out here: 21 versions. The JSON record has them.