OS Command Injection in Usermin Affects Mail Module by Webmin
CVE-2026-123620

7.7HIGH

Key Information:

Vendor

Webmin

Status
Usermin
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123620?

Usermin version 2.570 suffers from an OS command injection vulnerability within its Read Mail module. This issue arises when authenticated users manipulate unsanitized IMAP folder names, allowing attackers to create folders containing shell metacharacters via external IMAP clients. By subsequently deleting these folders within Usermin, attackers can execute arbitrary commands as the user’s system account, thus circumventing restrictions that are typically enforced in webmail interfaces. This vulnerability highlights the importance of proper input sanitization to protect against command injection exploits.

Affected Version(s)

usermin 0 <= 2.570

References

https://github.com/webmin/usermin/issues/142
issue-tracking
https://github.com/webmin/usermin
product
https://github.com/webmin/usermin/commit/8a45420282ff04c9...
patch

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
Ilia Ross (iliaross)
.