Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Usermin lets signed‑in users run system commands

CVE-2026-123620 · published 3 days ago
Summary

Usermin versions up to 2.570 let a user who is logged in create a mail folder with special characters and then delete it, causing the server to run arbitrary commands. This can give the attacker the same rights as the web server account and bypass mail‑only restrictions. Upgrade Usermin to the latest release or apply the vendor’s patch to sanitize folder names.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
webmin usermin <= 2.570
Original advisory text
Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion
Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.4 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published6 Nov 2026
Updated7 Nov 2026
First seen6 Nov 2026
Sources
CVE-2026-123620 · NVD
CVE-2026-123620 · MITRE
CVE-2026-123620 · OSV
Track software like this
Free during beta