{"id":"CVE-2026-123620","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-123620","summary":"Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion","details":"Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.","published":"2026-11-06T15:00:55.708Z","modified":"2026-11-07T02:48:23.840695397Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/webmin/usermin/commit/8a45420282ff04c943f05d9241a3c55afb9bca79","label":"webmin/usermin@8a45420"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123620.json"},{"type":"PACKAGE","url":"https://github.com/webmin/usermin"},{"type":"ARTICLE","url":"https://github.com/webmin/usermin/blob/2.570/mailbox/mailbox-lib.pl#L1031-L1040"},{"type":"FIX","url":"https://github.com/webmin/usermin/commit/8a45420282ff04c943f05d9241a3c55afb9bca79"},{"type":"REPORT","url":"https://github.com/webmin/usermin/issues/142"},{"type":"ARTICLE","url":"https://hackmd.io/@leediay/H144QKY6zl"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123620"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/usermin-through-2.570-os-command-injection-via-read-mail-imap-folder-deletion"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-07T02:48:23.840695397Z"}}