CVE-2026-123620 | BDVDB-2026-401260 Detail
webminusermin
Description#
Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
References#
- https://github.com/webmin/usermin/issues/142
- https://github.com/webmin/usermin
- https://github.com/webmin/usermin/commit/8a45420282ff04c943f05d9241a3c55afb9bca79
- https://github.com/webmin/usermin/blob/2.570/mailbox/mailbox-lib.pl#L1031-L1040
- https://hackmd.io/@leediay/H144QKY6zl
- https://www.vulncheck.com/advisories/usermin-through-2.570-os-command-injection-via-read-mail-imap-folder-deletion
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.