HIGH 7.7 NVD
CVE-2026-123620
Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanit
Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.
References
- https://github.com/webmin/usermin
- https://github.com/webmin/usermin/blob/2.570/mailbox/mailbox-lib.pl#L1031-L1040
- https://github.com/webmin/usermin/commit/8a45420282ff04c943f05d9241a3c55afb9bca79
- https://github.com/webmin/usermin/issues/142
- https://hackmd.io/@leediay/H144QKY6zl
This high severity vulnerability with a CVSS score of 7.7 was published on 2026-11-06 via NVD.
vulnfeed aggregates 16326 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.