CVE Alert: CVE-2026-123620 – webmin

Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.

**Risk verdict:** High risk on internet- or internally reachable deployments; available data does not establish active exploitation, so urgency should be driven by exposure and local evidence.

**Why this matters:** Successful command execution could compromise confidentiality, integrity and availability on the host under the application’s system account. An attacker may use an ordinary account to access data, alter services or disrupt mail-related operations; the achievable impact depends on that account’s permissions.

**Most likely attack path:** The service is network-reachable, requires low-level authenticated access and no victim interaction, but exploitation depends on a crafted folder being present first. That prerequisite may raise practical complexity despite the low-complexity rating in another assessment. Scope is unchanged: expect impact within the service host’s security authority, not automatic cross-system compromise.

**Who is most exposed:** Prioritise internet-facing webmail portals and deployments where users can manage IMAP folders, especially where the service account has broad host permissions.

Review application and IMAP logs for unusual folder names or deletion events.

Alert on shell or command-interpreter processes spawned by the web application.

Hunt for unexpected files, processes, outbound connections or changes owned by the service account.

Check whether suspicious folder creation preceded deletion.

Mitigation and prioritisation

Upgrade promptly to a vendor-fixed release; verify the deployed build and restart affected services as required.

Until patched, restrict network access and disable or limit the affected mail functionality where operationally safe.

Reduce service-account permissions and review recent activity for signs of command execution.

KEV, SSVC exploitation state, PoC status and EPSS are not supplied; verify these before final prioritisation. If KEV is true or EPSS is at least 0.5, **treat as priority 1**.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.