CVE-2026-2469
IMAP Injection in directorytree/imapengine Allows Email Manipulation
Publication date: 2026-02-14
Last updated on: 2026-04-29
Assigner: Snyk
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| directorytree | imapengine | to 1.22.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-2469 is a vulnerability in the directorytree/imapengine package versions before 1.22.3. It arises from improper escaping of user input in the id() function within ImapConnection.php. Specifically, user-supplied strings are directly included in IMAP ID commands without proper sanitization, allowing attackers to inject special characters such as quote characters (") or CRLF sequences (\\r\\n).'}, {'type': 'paragraph', 'content': "This improper neutralization of special elements leads to an injection vulnerability where an attacker can insert arbitrary IMAP commands into the victim's mailbox session."}] [1, 4]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "Exploiting this vulnerability allows an attacker to execute arbitrary IMAP commands on a victim's mailbox. This can lead to several impacts:"}, {'type': 'list_item', 'content': "Reading the victim's emails by injecting FETCH commands."}, {'type': 'list_item', 'content': 'Deleting emails using STORE and EXPUNGE commands.'}, {'type': 'list_item', 'content': "Terminating the victim's IMAP session via LOGOUT commands, causing denial of service."}, {'type': 'list_item', 'content': 'Executing any valid IMAP command, potentially compromising confidentiality, integrity, and availability of mailbox data.'}] [1, 4]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'Detection of this vulnerability involves identifying whether the DirectoryTree/ImapEngine package version is prior to 1.22.3 and if the id() function in ImapConnection.php is used without proper escaping of user input.'}, {'type': 'paragraph', 'content': 'One practical approach is to monitor IMAP traffic for suspicious ID commands containing quote characters (") or CRLF sequences (\\r\\n) that could indicate injection attempts.'}, {'type': 'paragraph', 'content': 'A proof-of-concept involves sending crafted IMAP ID commands with injected payloads such as:'}, {'type': 'list_item', 'content': 'evil"\\r\\nA999 FETCH 1 BODY[]\\r\\nA998 ID ("x'}, {'type': 'paragraph', 'content': 'To detect exploitation attempts on your system, you can capture and analyze IMAP traffic using tools like tcpdump or Wireshark filtering for IMAP commands containing suspicious characters.'}, {'type': 'list_item', 'content': 'tcpdump -i <interface> -A port 143 | grep -E \'ID|"|\\r\\n\''}, {'type': 'paragraph', 'content': 'Additionally, reviewing application logs for unexpected IMAP commands or session terminations may help identify exploitation.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The primary and immediate mitigation step is to upgrade the DirectoryTree/ImapEngine package to version 1.22.3 or later, where the vulnerability has been fixed by properly escaping user input in the id() function.
If upgrading immediately is not possible, consider applying the patch from the official pull request that introduces escaping of ID command parameters.
Additionally, restrict or sanitize any user input that is passed to the id() function to prevent injection of special characters such as quotes or CRLF sequences.
Monitoring and alerting on suspicious IMAP commands can also help mitigate the impact by detecting exploitation attempts early.