Read the docs
TI-2026-85958 Aliases CVE-2026-123620GHSA-x534-mp2r-76p8

OS command injection in Usermin Read Mail IMAP folder deletion

Priority LOW 36CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Usermin through 2.570 contains an OS command injection flaw in its Read Mail module (CWE-78). The module does not sanitize IMAP folder names, so shell metacharacters in a folder name reach the operating system. An authenticated user can create such a folder with an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing restrictions that limit them to webmail.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.

Why it matters now

EPSS 0.01376 72nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Webminuserminup to 2.570—No fix listedCNA
  • usermin VendorWebmin Affected up to 2.570 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Usermin.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-123620
  2. 2026-11-06 Alias added: GHSA-x534-mp2r-76p8
  3. 2026-11-08 Priority changed: MEDIUM → LOW

References

Patch 1

Other 4

  • TI-2019-11278 An issue was discovered in Webmin <=1.920. KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-16770 software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command. CVSS 3.1CRITICAL 9.8
  • TI-2022-00731 Improper Access Control to Remote Code Execution in webmin/webmin CVSS 3.1HIGH 8.8
  • TI-2019-09619 In Webmin through 1.910, any user authorized to the "Package Updates" module can execute… CVSS 3.0HIGH 8.8
  • TI-2015-01866 Code injection in Usermin CVSS 3.1CRITICAL 9.9
  • TI-2022-15852 Usermin through 1.850 allows a remote authenticated user to execute OS commands via… CVSS 3.1HIGH 8.8
See all 121 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences