Vulnerability · Published Feb 14, 2026 · Assigned by snyk
CVE-2026-2469
High 7.6
In plain English
A high-severity injection in directorytree/imapengine. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands. This allows attackers to read or delete victim's emails, terminate the victim's session or execute any valid IMAP command on victim's mailbox by including quote characters " or CRLF sequences \r\n in the input.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | directorytree/imapengine | 1.22.3 | GHSA-rfq9-4wcm-64gh |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | directorytree/imapengine | 0 – before 1.22.3 |
Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H/E:P