CVE-2026-123620Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion

Beschreibung

Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Issue #142 issue-tracking
• https://github.com/webmin/usermin product
• Fix commit 8a45420 patch
• delete_folder in mailbox-lib.pl technical-description
• Researcher write-up technical-description
• VulnCheck Advisory: Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion third-party-advisory