{"id":"CVE-2026-123620","title":"Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion","summary":"Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metach…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-78"],"vendor":"webmin","product":"usermin","affected":["usermin <= 2.570"],"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:00:55.708Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-123620","references":[{"url":"https://github.com/webmin/usermin/issues/142","label":"GitHub Issue #142"},{"url":"https://github.com/webmin/usermin"},{"url":"https://github.com/webmin/usermin/commit/8a45420282ff04c943f05d9241a3c55afb9bca79","label":"Fix commit 8a45420"},{"url":"https://github.com/webmin/usermin/blob/2.570/mailbox/mailbox-lib.pl#L1031-L1040","label":"delete_folder in mailbox-lib.pl"},{"url":"https://hackmd.io/@leediay/H144QKY6zl","label":"Researcher write-up"},{"url":"https://www.vulncheck.com/advisories/usermin-through-2.570-os-command-injection-via-read-mail-imap-folder-deletion","label":"VulnCheck Advisory: Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion"}],"tags":["cve.org"],"ingestedAt":"2026-11-06T15:54:04.081Z","epss":0.01376,"epssPercentile":0.72206,"slug":"CVE-2026-123620","body":"## Overview\n\nUsermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.\n\n## Affected\n\n- `usermin <= 2.570`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}