~ / search / GHSA-rfq9-4wcm-64gh

GHSA-rfq9-4wcm-64gh

ImapEngine affected by command injection via the ID command parameters

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-2469

Packages

EcosystemPackageAffectedFixed in
Packagist directorytree/imapengine < 1.22.3 1.22.3

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package `directorytree/imapengine` before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands. This allows attackers to read or delete victim's emails, terminate the victim's session or execute any valid IMAP command on victim's mailbox by including quote characters `"` or CRLF sequences `\r\n` in the input.

References

External links from the advisory. They lead to third-party sites.