Improper neutralization of CRLF sequences in the construction of IMAP commands allows an attacker to inject additional commands into an authenticated upstream mailbox connection. This type of injection can enable delivery or deletion of messages, modification of mailbox contents, or execution of arbitrary actions that the mailbox account normally permits, thereby compromising confidentiality and integrity of mail data.

The vulnerable software is psyb0t's docker-mailbox, versions prior to 0.4.13. Any deployment of this container image using a version older than 0.4.13 without bearer-token authentication is within scope and is therefore affected.

The CVSS score of 9.4 categorises this flaw as critical. The EPSS score is not available, so no quantification of exploitation likelihood is provided. The vulnerability is not listed in the CISA KEV catalog. Attackers can reach the flaw remotely without authentication only when bearer-token authentication is not enabled; the injection occurs at the point where folder, UID, or search values are incorporated into IMAP commands by the docker-mailbox service.