7.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-2469

CVE-2026-2469: ImapEngine affected by command injection via the ID command parameters

Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands. This allows attackers to read or delete victim's emails, terminate the victim's session or execute any valid IMAP command on victim's mailbox by including quote characters " or CRLF sequences \r\n in the input.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-2469

CVE-2026-2469:

7.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
directorytree/imapengine	composer	< 1.22.3	1.22.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the id function of the ImapConnection class, as identified in the commit 87fca56affd9527e6907a705e6d600c5174d9a5a. The patch applied to src/Connection/ImapConnection.php clearly shows that user-provided input from the $ids array was being concatenated directly into an IMAP command string without any sanitization or escaping. The vulnerable line, - $token .= '"'.$id.'" ';, was replaced with a call to Str::escape($id), which properly neutralizes special characters. This directly addresses the vulnerability described, which is an injection attack via the ID command parameters. The new test case added in tests/Unit/Connection/ImapConnectionTest.php further confirms this by attempting to inject a LOGOUT command and asserting that the input is correctly escaped, proving that ImapConnection::id is the function where the vulnerability is triggered.

Vulnerable functions

ImapConnection::id

src/Connection/ImapConnection.php

The `id` function in `ImapConnection.php` is vulnerable to command injection. It constructs an IMAP ID command by iterating through the user-provided `$ids` array and concatenating each value directly into the command string. The original code (`- $token .= '"'.$id.'" ';`) does not escape special characters within the `$id` variable. This allows an attacker to inject characters like double quotes (`"`) or CRLF sequences (`\r\n`) to break out of the intended string and append arbitrary IMAP commands. The patch mitigates this by introducing the `Str::escape()` function to neutralize these special characters before they are included in the command.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.