CVE-2026-123620

high

Description

Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.

References

https://www.vulncheck.com/advisories/usermin-through-2.570-os-command-injection-via-read-mail-imap-folder-deletion

https://hackmd.io/@leediay/H144QKY6zl

https://github.com/webmin/usermin/issues/142

https://github.com/webmin/usermin/commit/8a45420282ff04c943f05d9241a3c55afb9bca79

https://github.com/webmin/usermin/blob/2.570/mailbox/mailbox-lib.pl#L1031-L1040

https://github.com/webmin/usermin

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-118296

Details

Source: Mitre, NVD

Published: 2026-11-06

Updated: 2026-11-12

Risk Information

CVSS v2

Base Score: 7.1

Vector: CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: High

CVSS v4

Base Score: 7.7

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.01376