{"id":"CVE-2026-123620","aliases":["EUVD-2026-118296","GHSA-x534-mp2r-76p8"],"status":"published","title":"Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion","description":"Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01376,"percentile":0.72437,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2026-11-06T15:00:55Z","modified":"2026-11-07T02:48:23Z","products":[{"vendor":"usermin","product":"usermin"},{"vendor":"webmin","product":"usermin"}],"references":[{"url":"https://github.com/webmin/usermin/issues/142","tags":["issue-tracking","report"]},{"url":"https://github.com/webmin/usermin","tags":["product","package"]},{"url":"https://github.com/webmin/usermin/commit/8a45420282ff04c943f05d9241a3c55afb9bca79","tags":["patch","fix"]},{"url":"https://github.com/webmin/usermin/blob/2.570/mailbox/mailbox-lib.pl#L1031-L1040","tags":["technical-description","article"]},{"url":"https://hackmd.io/@leediay/H144QKY6zl","tags":["technical-description","article"]},{"url":"https://www.vulncheck.com/advisories/usermin-through-2.570-os-command-injection-via-read-mail-imap-folder-deletion","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123620","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x534-mp2r-76p8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123620.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-123620","title":"Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion","description":"Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.","status":"published","published":"2026-11-06T15:00:55.708Z","modified":"2026-11-09T22:45:40.895Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-09T23:35:21.703923Z"}],"euvd":[{"id":"EUVD-2026-118296","description":"Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.","status":"published","published":"2026-11-06T15:00:55Z","modified":"2026-11-09T22:45:40Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-10T00:18:43.414497Z"}],"ghsa":[{"id":"GHSA-x534-mp2r-76p8","title":"Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that...","description":"Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.","status":"published","published":"2026-11-06T15:31:27Z","modified":"2026-11-06T15:31:28Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-06T16:00:40.695019Z"}],"nvd":[{"id":"CVE-2026-123620","description":"Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.","status":"published","published":"2026-11-06T15:17:19.54Z","modified":"2026-11-09T23:17:15.773Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-10T02:16:32.988634Z"}],"osv":[{"id":"CVE-2026-123620","title":"Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion","description":"Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.","status":"published","published":"2026-11-06T15:00:55.708Z","modified":"2026-11-11T02:30:45.688371442Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-08T02:57:14.556074Z"}]}}