CVE-2026-123620Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion

Açıklama

Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Issue #142 issue-tracking
• https://github.com/webmin/usermin product
• Fix commit 8a45420 patch
• delete_folder in mailbox-lib.pl technical-description
• Researcher write-up technical-description
• VulnCheck Advisory: Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion third-party-advisory