CVE-2026-123620
Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that…
- Risk score
- 45/100
- CVSS
- 7.5 v3.1
- Published
- 6 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
References
- https://github.com/webmin/usermin
- https://github.com/webmin/usermin/blob/2.570/mailbox/mailbox-lib.pl#L1031-L1040
- https://github.com/webmin/usermin/commit/8a45420282ff04c943f05d9241a3c55afb9bca79
- https://github.com/webmin/usermin/issues/142
- https://hackmd.io/@leediay/H144QKY6zl
- https://www.vulncheck.com/advisories/usermin-through-2.570-os-command-injection-via-read-mail-imap-folder-deletion
Original description
Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.
Last activity 6 Nov 2026. Patch Forecast updates every hour.