directorytree imapengine up to 1.22.2 Downstream ImapConnection.php id injection

Summaryinfo

A vulnerability marked as problematic has been reported in directorytree imapengine up to 1.22.2. Affected is the function ID of the file ImapConnection.php of the component Downstream Component. Performing a manipulation results in injection. This vulnerability was named CVE-2026-2469. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in directorytree imapengine up to 1.22.2. It has been classified as critical. This affects the function id of the file ImapConnection.php of the component Downstream Component. The manipulation with an unknown input leads to a injection vulnerability. CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands. This allows attackers to read or delete victim's emails, terminate the victim's session or execute any valid IMAP command on victim's mailbox by including quote characters " or CRLF sequences \r\n in the input.

The advisory is shared at security.snyk.io. This vulnerability is uniquely identified as CVE-2026-2469 since 02/13/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1055 for this issue.

By approaching the search of inurl:ImapConnection.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.22.3 eliminates this vulnerability. Applying the patch 87fca56affd9527e6907a705e6d600c5174d9a5a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• directorytree

Name

• imapengine

Version

• 1.22.0
• 1.22.1
• 1.22.2

License

• open-source

Website

• Product: https://github.com/DirectoryTree/ImapEngine/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion