Read the docs
TI-2026-02098 Aliases CVE-2026-2469GHSA-rfq9-4wcm-64gh

Injection in directorytree/imapengine

Priority HIGH 71CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands. This allows attackers to read or delete victim's emails, terminate the victim's session or execute any valid IMAP command on victim's mailbox by including quote characters " or CRLF sequences \r\n in the input.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00395 33rd percentileScored 2026-11-07
Fix Fixed directorytree/imapengine: 1.22.3directorytree/imapengine (Packagist): 1.22.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—directorytree/imapenginebefore 1.22.31.22.3Patch availableCNA
—directorytree/imapengine (Packagist)before 1.22.31.22.3Patch availableGHSA-rfq9-4wcm-64gh
  • directorytree/imapengine Vendor— Affected before 1.22.3 Fixed in 1.22.3 Patch available CNA
  • directorytree/imapengine (Packagist) Vendor— Affected before 1.22.3 Fixed in 1.22.3 Patch available GHSA-rfq9-4wcm-64gh

Remediation

  • Fix · CNA directorytree/imapengine Fixed in 1.22.3
  • Fix · GHSA-rfq9-4wcm-64gh directorytree/imapengine (Packagist) Fixed in 1.22.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-2469
  2. 2026-10-03 Alias added: GHSA-rfq9-4wcm-64gh

References

Advisory 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences