# CVE-2026-123620: Usermin command injection in Read Mail module

Source: https://junglewise.ai/threats/cve-2026-123620-usermin-through-2-570-contains-an-os-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-123620 · Severity: high · CVSS 7.5 · Published 2026-11-06

Usermin is a webmail and system administration interface that allows users to manage email and other services. Through version 2.570, authenticated users can inject shell commands into IMAP folder names, which are executed when those folders are deleted in the web interface. This allows attackers with valid accounts to run arbitrary system commands with the privileges of their user account.

Vendors: [Webmin](https://junglewise.ai/threats/vendors/webmin).

## Quick answers

**Is CVE-2026-123620 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123620 being exploited in the wild.

**How severe is CVE-2026-123620?** High severity, with a CVSS score of 7.5, published 6 November 2026.

**Which products and versions are affected?** Webmin Usermin through 2.570.

**Is there a fix for CVE-2026-123620?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-123620 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-123620?** Check whether you run Webmin Usermin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability exists in the Read Mail module's handling of IMAP folder names. The vulnerability arises from unsanitized folder names passed to shell commands during folder deletion operations. An authenticated attacker can create a folder with shell metacharacters via an external IMAP client, then trigger command execution through the Usermin delete operation, allowing code execution as the authenticated user.

## Affected products

- Webmin Usermin through 2.570

## Timeline

- 2026-11-06: disclosed

## References

- [https://github.com/webmin/usermin](https://github.com/webmin/usermin)
- [https://github.com/webmin/usermin/blob/2.570/mailbox/mailbox-lib.pl](https://github.com/webmin/usermin/blob/2.570/mailbox/mailbox-lib.pl)

## Related threats

- [Usermin cross-site scripting in mailbox attachment handling](https://junglewise.ai/threats/cve-2026-123622-usermin-through-2-570-contains-a-cross-site-scripting)