---
id: "CVE-2026-123620"
page: "https://infrastack.ai/live/CVE-2026-123620"
kind: "vulnerability"
aliases: ["CVE-2026-123620"]
title: "Usermin: IMAP folder names let a logged-in user run system commands"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["linux", "runtime", "self-hosted", "usermin", "webmail"]
not_affected_if: ["auth-required", "usermin-not-installed"]
published_at: "2026-11-06T15:17:19+00:00"
first_seen_at: "2026-11-06T15:42:44+00:00"
updated_at: "2026-11-06T15:44:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123620", "first_seen_at": "2026-11-06T15:42:44+00:00"}]
exploit_sources: []
---

# Usermin: IMAP folder names let a logged-in user run system commands

Link for people: https://infrastack.ai/live/CVE-2026-123620 (this .md is for agents)

Usermin's Read Mail module passes IMAP folder names to a shell without sanitizing them. An authenticated user can create a folder with shell metacharacters through an external IMAP client, then delete it in Usermin to run commands as their system account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Usermin version (for example `usermin --version` or the package manager's query) and compare it with the fixed version in the sources.
- Confirm whether the Read Mail module is enabled and whether users have IMAP access to their accounts.

## Fix

- Usermin: unknown (the sources name a patch on github.com but do not state the fixed version).

## Timeline

- 2026-11-06T15:42:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123620

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/usermin-through-2.570-os-command-injection-via-read-mail-imap-folder-deletion
- [fix] Patch: github.com https://github.com/webmin/usermin/commit/8a45420282ff04c943f05d9241a3c55afb9bca79

## From the sources

Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_