CVE-2026-2469: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in directorytree/imapengine
Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands. This allows attackers to read or delete victim's emails, terminate the victim's session or execute any valid IMAP command on victim's mailbox by including quote characters " or CRLF sequences \r\n in the input.
AI Analysis
Technical Summary
CVE-2026-2469 is an injection vulnerability affecting directorytree/imapengine versions prior to 1.22.3. The vulnerability is due to improper neutralization of special elements in output used by a downstream component, specifically in the id() function within ImapConnection.php. User input is not properly escaped before being included in IMAP ID commands, allowing injection of quote characters or CRLF sequences. This can enable an attacker with limited privileges to execute arbitrary IMAP commands on the victim's mailbox, including reading or deleting emails and terminating the victim's session.
Potential Impact
An attacker can leverage this vulnerability to execute any valid IMAP command on a victim's mailbox. This includes reading or deleting the victim's emails and terminating their IMAP session. The vulnerability requires low attack complexity and no user interaction, but does require some privileges. The overall impact is high due to potential loss of confidentiality and availability of email data.
Mitigation Recommendations
A fix is available in directorytree/imapengine version 1.22.3. Users should upgrade to version 1.22.3 or later to remediate this vulnerability. No other mitigation guidance is provided or necessary once the update is applied.
CVE-2026-2469: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in directorytree/imapengine
Description
Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands. This allows attackers to read or delete victim's emails, terminate the victim's session or execute any valid IMAP command on victim's mailbox by including quote characters " or CRLF sequences \r\n in the input.
CVSS v4.0
Score 7.2high
Affected software
directorytree/imapengine
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-2469 is an injection vulnerability affecting directorytree/imapengine versions prior to 1.22.3. The vulnerability is due to improper neutralization of special elements in output used by a downstream component, specifically in the id() function within ImapConnection.php. User input is not properly escaped before being included in IMAP ID commands, allowing injection of quote characters or CRLF sequences. This can enable an attacker with limited privileges to execute arbitrary IMAP commands on the victim's mailbox, including reading or deleting emails and terminating the victim's session.
Potential Impact
An attacker can leverage this vulnerability to execute any valid IMAP command on a victim's mailbox. This includes reading or deleting the victim's emails and terminating their IMAP session. The vulnerability requires low attack complexity and no user interaction, but does require some privileges. The overall impact is high due to potential loss of confidentiality and availability of email data.
Mitigation Recommendations
A fix is available in directorytree/imapengine version 1.22.3. Users should upgrade to version 1.22.3 or later to remediate this vulnerability. No other mitigation guidance is provided or necessary once the update is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- snyk
- Date Reserved
- 2026-02-13T14:30:50.548Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 69901846c9e1ff5ad867f1ae
Added to database: 02/14/2026, 06:37:58 UTC
Last enriched: 07/30/2026, 22:55:55 UTC
Last updated: 09/10/2026, 22:09:18 UTC
Views: 181
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.