GHSA-rfq9-4wcm-64gh

Suggest an improvement
Source
https://github.com/advisories/GHSA-rfq9-4wcm-64gh
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-rfq9-4wcm-64gh/GHSA-rfq9-4wcm-64gh.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-rfq9-4wcm-64gh
Aliases
Published
2026-02-14T06:30:58Z
Modified
2026-02-17T17:11:27.785507Z
Severity
  • 7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H CVSS Calculator
  • 5.7 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
ImapEngine affected by command injection via the ID command parameters
Details

Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands. This allows attackers to read or delete victim's emails, terminate the victim's session or execute any valid IMAP command on victim's mailbox by including quote characters " or CRLF sequences \r\n in the input.

Database specific 
{
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-74"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-17T16:40:46Z",
    "nvd_published_at": "2026-02-14T05:16:22Z"
}
References

Affected packages

Packagist / directorytree/imapengine

Package

Name
directorytree/imapengine
Purl
pkg:composer/directorytree/imapengine

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.22.3

Affected versions

v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.4.0
v1.4.1
v1.4.2
v1.5.0
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.7.1
v1.8.0
v1.9.0
v1.10.0
v1.10.1
v1.11.0
v1.11.1
v1.11.2
v1.12.0
v1.12.1
v1.13.0
v1.13.1
v1.13.2
v1.13.3
v1.13.4
v1.13.5
v1.13.6
v1.13.7
v1.13.8
v1.14.0
v1.15.0
v1.15.1
v1.15.2
v1.15.3
v1.15.4
v1.15.5
v1.16.0
v1.16.1
v1.16.2
v1.17.0
v1.17.1
v1.17.2
v1.17.3
v1.18.0
v1.18.1
v1.18.2
v1.18.3
v1.18.4
v1.18.5
v1.18.6
v1.19.0
v1.19.1
v1.19.2
v1.20.0
v1.20.1
v1.21.0
v1.22.0
v1.22.1
v1.22.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-rfq9-4wcm-64gh/GHSA-rfq9-4wcm-64gh.json"