Description

Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-06T15:17:19.540Z",
  "pubdate": "2026-11-06T15:17:19.540Z",
  "executiveSummary": "Usermin versions up to 2.570 are vulnerable to an OS command injection flaw located within the Read Mail module.\nThe vulnerability arises from insufficient sanitization of IMAP folder names, which allows an authenticated attacker to execute arbitrary system commands with the privileges of the victim's system account.\nBy leveraging an external IMAP client, an attacker can craft a malicious folder name containing shell metacharacters.\nThe primary impact is complete account compromise, as the execution occurs within the context of the user, potentially enabling further lateral movement or privilege escalation on the host system.\nExploitation requires authenticated access to the Usermin interface and the ability to interact with the mail system, effectively bypassing security controls designed to restrict webmail-only operations.\nThis represents a critical risk to multi-user environments where Usermin is deployed, as it grants authenticated users an escalation path to arbitrary code execution.",
  "technicalDetails": "The vulnerability resides in the Read Mail module of Usermin, which fails to adequately sanitize IMAP folder names when processing delete operations.\nRoot Cause: The application improperly passes untrusted input (the IMAP folder name) to an underlying system shell or sub-process without performing robust input validation or utilizing secure API alternatives that prevent shell metacharacter interpretation.\nExploitation Flow: An attacker first establishes a connection to the IMAP service provided by the host. Using an external IMAP client, the attacker creates a new mail folder where the name attribute is crafted to include shell metacharacters (e.g., semicolons, pipes, or backticks followed by malicious commands).\nOnce the folder is created, the attacker logs into the Usermin web interface and navigates to the Read Mail module. The attacker then triggers the folder deletion process.\nThe backend logic of the Read Mail module attempts to handle the folder deletion by invoking a system command, incorporating the unsanitized folder name provided by the user. Because the name contains shell-executable characters, the system shell interprets these characters as instructions, executing the injected commands as the system user.\nTechnical Impact: The execution occurs under the privileges of the system account associated with the webmail user. This circumvents the intended security boundaries of the Usermin web interface, which is designed to limit user capabilities to mail management tasks. By successfully injecting shell commands, the attacker gains the ability to execute arbitrary code, read or write files within the user's home directory, or potentially exploit local system weaknesses to escalate privileges further.\nAffected Versions: Usermin up to 2.570.\nRequirements: The attacker must have valid authentication credentials for the Usermin instance and access to the IMAP service to create the malicious directory structure. The vulnerability is triggered through the specific workflow of deleting the malformed folder via the web UI."
}