ImapEngine versions prior to 1.22.3 embed user supplied data directly into IMAP ID commands without proper escaping. This flaw, classified as CWE-74, allows an attacker to inject quote characters or CRLF sequences into the command string. By exploiting this, an attacker can read or delete mailbox contents, terminate a victim’s IMAP session, or execute any valid IMAP command on the victim’s mailbox, resulting in unauthorized data exposure, loss, or modification.

The vulnerable product is DirectoryTree’s ImapEngine. All releases before 1.22.3 are affected. No other major versions are listed as impacted.

The CVSS score of 7.2 indicates moderate severity, while an EPSS score of less than 1 % suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a specially crafted IMAP ID command, which implies that a user session or an automated IMAP client can act as the attack vector. Based on the description, the likely attack path involves feeding unsanitized input into the id() function from a downstream IMAP component.