What is CVE-2026-2469?

CVE-2026-2469 is a high-severity vulnerability in Directorytree/imapengine, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 7.6/10. Published 2026-02-14.

How severe is CVE-2026-2469?

High severity. CVSS v3 base score is 7.6 out of 10.

Vulnerability in Directorytree/imapengine

CVE-2026-2469

Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands. This allows attackers to read or delete victim's emails, terminate the victim's session or execute any valid IMAP command on victim's mailbox by including quote characters " or CRLF sequences \r\n in the input.

EPSS: 0.004 (27.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H.

Affected products

N/a Directorytree/imapengine — versions 0

Weakness classification (CWE)

CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

References

Frequently asked questions

What is CVE-2026-2469?: CVE-2026-2469 is a high-severity vulnerability in Directorytree/imapengine, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 7.6/10. Published 2026-02-14.
How severe is CVE-2026-2469?: High severity. CVSS v3 base score is 7.6 out of 10.