Threats tagged 'ghsa-x534-mp2r-76p8'

Usermin versions up to 2.570 have an OS command injection vulnerability in the Read Mail module. Authenticated users can exploit unsanitized IMAP folder names containing shell metacharacters to execute arbitrary commands as their system account. This bypasses webmail-only restrictions by leveraging folder deletion functionality.