GHSA-x534-mp2r-76p8HighCVSS 7.5
Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that...
🔗 CVE IDs covered (1)
📋 Description
Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.
🔗 References (8)
- https://nvd.nist.gov/vuln/detail/CVE-2026-123620
- https://github.com/webmin/usermin/issues/142
- https://github.com/webmin/usermin/commit/8a45420282ff04c943f05d9241a3c55afb9bca79
- https://github.com/webmin/usermin
- https://github.com/webmin/usermin/blob/2.570/mailbox/mailbox-lib.pl#L1031-L1040
- https://hackmd.io/@leediay/H144QKY6zl
- https://www.vulncheck.com/advisories/usermin-through-2.570-os-command-injection-via-read-mail-imap-folder-deletion
- https://github.com/advisories/GHSA-x534-mp2r-76p8