{"id":"CVE-2026-123620","published":"2026-11-06T15:17:19.540","lastModified":"2026-11-09T23:17:15.773","description":"Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/webmin/usermin","tags":[]},{"url":"https://github.com/webmin/usermin/blob/2.570/mailbox/mailbox-lib.pl#L1031-L1040","tags":[]},{"url":"https://github.com/webmin/usermin/commit/8a45420282ff04c943f05d9241a3c55afb9bca79","tags":[]},{"url":"https://github.com/webmin/usermin/issues/142","tags":[]},{"url":"https://hackmd.io/@leediay/H144QKY6zl","tags":[]},{"url":"https://www.vulncheck.com/advisories/usermin-through-2.570-os-command-injection-via-read-mail-imap-folder-deletion","tags":[]}],"exploitRefs":[{"url":"https://github.com/webmin/usermin","tags":[]},{"url":"https://github.com/webmin/usermin/blob/2.570/mailbox/mailbox-lib.pl#L1031-L1040","tags":[]},{"url":"https://github.com/webmin/usermin/commit/8a45420282ff04c943f05d9241a3c55afb9bca79","tags":[]},{"url":"https://github.com/webmin/usermin/issues/142","tags":[]}],"hasPoc":true,"ai":null}