CVE-2026-123620

EUVD-2026-118296
Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.5 HIGH
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
webminusermin
𝑥
≤ 2.570
CNA
Common Weakness Enumeration
References
https://github.com/webmin/usermin
https://github.com/webmin/usermin/blob/2.570/mailbox/mailbox-lib.pl#L1031-L1040
https://github.com/webmin/usermin/commit/8a45420282ff04c943f05d9241a3c55afb9bca79
https://github.com/webmin/usermin/issues/142
https://hackmd.io/@leediay/H144QKY6zl
https://www.vulncheck.com/advisories/usermin-through-2.570-os-command-injection-via-read-mail-imap-folder-deletion