Usermin, the Webmin-based system administration tool, contains an OS command injection flaw in the Read Mail module that allows an authenticated user to execute arbitrary shell commands. The vulnerability arises because the application passes unsanitized IMAP folder names directly to the operating system command interpreter when a folder is deleted. By creating a folder name that includes shell metacharacters via an external IMAP client and then deleting that folder through the Usermin web interface, the attacker can run commands with the privileges of the Usermin process, which typically operates under the system account.

All installations of Usermin up to and including version 2.570 that expose the Read Mail functionality are affected. The flaw exists in the core Usermin product distributed under the Webmin:Usermin vendor and does not extend to later releases that have been patched.

The CVSS score of 7.7 indicates a high severity remote command execution risk. Because only authenticated access to Usermin is required, an attacker posing as a legitimate user can trigger the exploit with minimal effort. The EPSS score is not publicly available, and the vulnerability is not listed in the CISA KEV catalog, so the probability of widespread exploitation is uncertain; nevertheless, the impact is significant if exploited. The likely attack vector involves an attacker who can authenticate to Usermin creating a malicious IMAP folder containing shell metacharacters via an IMAP client, then deleting that folder in Usermin to cause execution of the injected command.