High severity7.5NVD Advisory· Published Nov 6, 2026
CVE-2026-123620
CVE-2026-123620
Description
Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/webmin/usermin/blob/2.570/mailbox/mailbox-lib.plnvd
- github.com/webmin/usermin/commit/8a45420282ff04c943f05d9241a3c55afb9bca79nvd
- github.com/webmin/usermin/issues/142nvd
- hackmd.io/@leediay/H144QKY6zlnvd
- www.vulncheck.com/advisories/usermin-through-2.570-os-command-injection-via-read-mail-imap-folder-deletionnvd
News mentions
0No linked articles in our index yet.