Skip to main content

Python imaplib CVE-2025-15366

MEDIUM
Command Injection (CWE-77)
2026-01-20 cna@python.org
Command Injection
5.9
CVSS 4.0 · Vendor: python
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Supply CRLF-embedded string as IMAP argument
  2. Delivery
    Application passes input unsanitized to imaplib._command()
  3. Exploit
    imaplib writes injected bytes to IMAP socket
  4. Execution
    IMAP server parses multiple commands from single transmission
  5. Impact
    Execute unauthorized IMAP commands under authenticated session

Vulnerability Assessment

Weakness
CWE
CWE-77
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that an application using imaplib passes externally controlled data - such as a user-supplied username, password, mailbox name, message UID, or search string - directly as an argument to an imaplib command method (e.g., login(), select(), search(), store(), copy()) without first stripping or rejecting control characters (bytes 0x00-0x1F, 0x7F). The attacker must have a path to influence that specific argument value, either through a web form, API parameter, or other user-facing input surface that the application forwards to imaplib. Limiting factors include: (1) PR:H - the attacker must operate through an application that unsafely proxies their input to imaplib; standalone or correctly coded imaplib consumers are not affected; (2) AT:P - the vulnerable code pattern (passing raw user input to imaplib) must be present in the deployed application; (3) the injection achieves IMAP-level command execution only within the bounds of the already-authenticated IMAP session - it does not grant OS-level code execution or escalate beyond the mail account's permissions.
Impact

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N) scores 5.9 (Medium). The PR:H metric is the dominant risk-reducing factor: to exploit this flaw, an attacker must already control input that reaches imaplib function arguments, which requires either a vulnerable application that forwards user-supplied strings directly to imaplib or a position of high privilege within that application's trust boundary. AT:P (Attack Requirements: Present) further constrains exploitation to deployments with this specific insecure coding pattern - the vulnerability does not affect imaplib in isolation, only in combination with applications that unsafely thread external input into IMAP commands. EPSS of 0.09% (26th percentile) is consistent with a library-level flaw requiring application-layer preconditions; this is not a remotely exploitable default-configuration issue. The VI:H (high integrity impact) reflects that successful injection can issue arbitrary IMAP commands - including DELETE, RENAME, or STORE - against the mail server under the authenticated session's privileges. VC:L indicates limited read exposure beyond what the authenticated session already permits. No public exploit code exists and no active exploitation is confirmed by CISA KEV, placing this solidly in a patch-and-monitor posture rather than emergency response.
Exploit ScenarioDerived

A web application allows users to specify an IMAP mailbox name to synchronize. The application passes the unsanitized mailbox name directly to imap.select(user_mailbox). An attacker submits the value 'INBOX\r\nSTORE 1:* +FLAGS (\\Deleted)\r\nEXPUNGE' as the mailbox name. The imaplib _command() method forwards this string verbatim, causing the IMAP server to interpret three commands - SELECT, STORE, and EXPUNGE - under the authenticated session, silently deleting all messages in the mailbox. No public exploit code is currently available, but the attack pattern is straightforward to construct manually given knowledge of the IMAP protocol.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Jul 24, 2026

Command injection in Python's standard library imaplib module allows IMAP protocol command injection when applications pass unsanitized user-controlled input to imaplib functions. Embedding CRLF or other C0 control characters (0x00-0x1F) in arguments such as usernames or mailbox names causes the imaplib._command() method to transmit multiple IMAP protocol commands instead of one, enabling an attacker to inject arbitrary IMAP commands against the mail server. The fix, confirmed via multiple CPython commits and vendor advisories (Red Hat RHSA-2026:4713 et al., Ubuntu USN-8018-3), adds a regex guard rejecting all control characters before command transmission. No public exploit code and no KEV listing exist at time of analysis; EPSS is 0.09% (26th percentile), indicating very low exploitation probability.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:54

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

RemediationAI

Apply the patched Python release for the affected branch as distributed by the upstream CPython project or your OS vendor. Red Hat users should apply whichever of RHSA-2026:4713, RHSA-2026:5315, RHSA-2026:6007, RHSA-2026:5393, or RHSA-2026:6464 corresponds to their RHEL version (https://access.redhat.com/errata/). Ubuntu users should apply USN-8018-3 (https://ubuntu.com/security/notices/USN-8018-3). Exact patched version numbers per Python branch are not independently confirmed from available data - consult the upstream commit list at https://github.com/python/cpython/issues/143921. As an application-level compensating control where an OS or Python upgrade is not immediately possible, validate all user-supplied strings before passing them to any imaplib method by rejecting input containing bytes in the range 0x00-0x1F or 0x7F. This mirrors the fix logic exactly and eliminates the injection vector without requiring a Python upgrade. Note that filtering at the application layer duplicates what the patched imaplib provides, so it should be treated as temporary. No functionality trade-off exists for rejecting control characters in IMAP usernames, mailbox names, or flag arguments - these are not valid in the IMAP protocol.

Affected ProductsAI

The vulnerability affects Python's imaplib standard library module across multiple CPython 3.x maintenance branches. Five distinct fix commits are referenced (6262704b, d0921efb, f2cd7ef8, 29818227, 71926d94), indicating patches were backported to at least five active Python release series. Red Hat has issued advisories RHSA-2026:4713, RHSA-2026:5315, RHSA-2026:6007, RHSA-2026:5393, and RHSA-2026:6464 covering affected RHEL Python packages. Ubuntu issued USN-8018-3. SUSE is also listed as a downstream distributor of the fix. Exact minimum-affected and first-fixed version numbers per branch are not confirmed in available data - consult the CPython issue tracker at https://github.com/python/cpython/issues/143921 and the Python security announcement at https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/ for per-branch version details.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Python's imaplib module (Lib/imaplib.py) implements the IMAP4 client protocol. IMAP is a line-oriented protocol where commands are delimited by CRLF (\r\n). Prior to the fix, the internal _command() method forwarded raw byte arguments to the server socket without inspecting them for embedded control characters. An argument containing \r\n could prematurely terminate the in-progress IMAP command line and begin a new, attacker-controlled command - a classic CWE-77 (Improper Neutralization of Special Elements used in a Command) pattern. The fix introduces a compiled regex _control_chars = re.compile(b'[\x00-\x1F\x7F]') and raises ValueError on detection, applied before any bytes are written to the server. This vulnerability class is analogous to SMTP/HTTP header injection where protocol delimiters embedded in user data enable command smuggling. CPE data is not explicitly provided, but the affected component is the imaplib module bundled across multiple Python 3.x release trains, with fix commits visible across at least five branches.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (python) PRIMARY 5.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
vuln.today AI 5.0 MEDIUM

AC:H reflects the prerequisite that an application must unsafely pass user input to imaplib; PR:H consistent with CVSS 4.0 source vector; no availability impact.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE 6.7 MEDIUM
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
Red Hat 7.1 MEDIUM

Primary rating from Vendor (python).

CVSS VectorVendor: python

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
High
User Interaction
None
Vulnerable system: Confidentiality
Low
Vulnerable system: Integrity
High
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

4
CVSS changed
Jul 07, 2026 - 18:22 NVD
5.9 (MEDIUM)
Patch released
Mar 19, 2026 - 11:15 nvd
Patch available
CVE Published
Jan 20, 2026 - 22:15 nvd
N/A
CVE Published
Jan 20, 2026 - 22:15 cve.org
MEDIUM 5.9

DescriptionCVE.org

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

Threat Intelligence Overview

EPSS Score
0.1%
Top 74% exploitable
Prevalence
High
Python standard library, deployed across most server and developer environments
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC Yes
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
No
Human Impact· derived
High

Priority Score

50
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +30
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

Same weakness CWE-77 – Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2016-3081 HIGH POC
8.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2017-6327 HIGH POC
8.8
CVE-2023-34960 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container bci/bci-sle15-kernel-module-devel:15.7-56.13 Container bci/spack:latest Container suse/kea:2.6 Container suse/kiosk/pulseaudio:17.0-68.30 Container suse/ltss/sle15.4/bci-base-fips:15.4.2.55 Container suse/manager/5.0/x86_64/server-migration-14-16:latest Container suse/mariadb:11.8.5-72.5 Container suse/multi-linux-manager/5.1/x86_64/server-migration-14-16:5.1.3.8.16.1 Container suse/postgres:16.14 Container suse/postgres:17.10 Container suse/postgres:18.3-contrib-65.3 Container suse/samba-client:latest Container suse/samba-server:4.21-71.24 Container suse/samba-toolbox:latest Container suse/sle-micro-rancher/5.2:latest Container suse/sle-micro/5.2/toolbox:14.2-7.11.246 Container suse/sle-micro/5.3/toolbox:16.3-6.11.222 Container suse/sle-micro/5.4/toolbox:16.3-5.19.222 Container suse/sle-micro/5.5/toolbox:16.3-3.12.133 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GCE Image server-database-migration-image Affected
Container suse/389-ds:latest Affected
Container suse/manager/4.3/proxy-httpd:4.3.16.2.9.73.17 Container suse/manager/4.3/proxy-salt-broker:4.3.16.2.9.63.18 Container suse/manager/4.3/proxy-ssh:4.3.16.2.9.63.12 Container suse/manager/4.3/proxy-tftpd:4.3.16.2.9.63.13 Container suse/manager/5.0/x86_64/proxy-httpd:latest Container suse/manager/5.0/x86_64/proxy-salt-broker:latest Container suse/manager/5.0/x86_64/proxy-ssh:latest Container suse/manager/5.0/x86_64/proxy-tftpd:latest Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:5.1.3.8.18.1 Container suse/multi-linux-manager/5.1/x86_64/proxy-squid:5.1.3.8.16.1 Container suse/multi-linux-manager/5.1/x86_64/proxy-ssh:5.1.3.8.16.1 Container suse/multi-linux-manager/5.1/x86_64/proxy-tftpd:5.1.3.8.16.1 Image SLES15-SP4-CHOST-BYOS-GCE Image SLES15-SP4-Micro-5-3-BYOS Image SLES15-SP4-Micro-5-3-BYOS-Azure Image SLES15-SP4-Micro-5-4-BYOS Image SLES15-SP4-Micro-5-4-BYOS-Azure Image SLES15-SP5-CHOST-BYOS-GCE Image proxy-httpd-image Image proxy-squid-image Image proxy-ssh-image Image proxy-tftpd-image Affected
Container suse/manager/5.0/x86_64/server:latest Image SLES15-SP4-BYOS-GCE Image SLES15-SP4-HPC-BYOS-GCE Image SLES15-SP4-HPC-GCE Image SLES15-SP4-Hardened-BYOS-GCE Image SLES15-SP4-SAP-Azure-LI-BYOS Image SLES15-SP4-SAP-Azure-LI-BYOS-Production Image SLES15-SP4-SAP-Azure-VLI-BYOS Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production Image SLES15-SP4-SAP-BYOS-GCE Image SLES15-SP4-SAP-GCE Image SLES15-SP4-SAP-Hardened-BYOS-GCE Image SLES15-SP4-SAP-Hardened-GCE Image SLES15-SP4-SAPCAL-GCE Image SLES15-SP5-BYOS-GCE Image SLES15-SP5-GCE Image SLES15-SP5-HPC-BYOS-GCE Image SLES15-SP5-Hardened-BYOS-GCE Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production Image SLES15-SP5-SAP-BYOS-GCE Image SLES15-SP5-SAP-Hardened-BYOS-GCE Image SLES15-SP5-SAP-Hardened-GCE Image SLES15-SP5-SAPCAL-GCE Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-GCE Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP-Azure-LI-BYOS Image SLES15-SP6-SAP-Azure-LI-BYOS-Production Image SLES15-SP6-SAP-Azure-VLI-BYOS Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production Image SLES15-SP6-SAP-BYOS-GCE Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAP-Hardened-BYOS-GCE Image SLES15-SP6-SAP-Hardened-GCE Image SLES15-SP6-SAPCAL-GCE Image SLES15-SP7-GCE Image SLES15-SP7-GCE-3P Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-GCE-3P Image SLES15-SP7-SAP-Hardened-GCE Image SLES15-SP7-SAPCAL-GCE Affected
Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.3.9.16.1 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP7-EC2-ECS-HVM Image proxy-salt-broker-image Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:16174 ADVISORY https://access.redhat.com/errata/RHSA-2026:2128 ADVISORY https://access.redhat.com/errata/RHSA-2026:4165 ADVISORY https://access.redhat.com/errata/RHSA-2026:4168 ADVISORY https://access.redhat.com/errata/RHSA-2026:4216 ADVISORY https://access.redhat.com/errata/RHSA-2026:4463 ADVISORY https://access.redhat.com/errata/RHSA-2026:4473 ADVISORY https://access.redhat.com/errata/RHSA-2026:4713 ADVISORY https://access.redhat.com/errata/RHSA-2026:4746 ADVISORY https://access.redhat.com/errata/RHSA-2026:4943 ADVISORY https://access.redhat.com/errata/RHSA-2026:5152 ADVISORY https://access.redhat.com/errata/RHSA-2026:5215 ADVISORY https://access.redhat.com/errata/RHSA-2026:5216 ADVISORY https://access.redhat.com/errata/RHSA-2026:5218 ADVISORY https://access.redhat.com/errata/RHSA-2026:5219 ADVISORY https://access.redhat.com/errata/RHSA-2026:5221 ADVISORY https://access.redhat.com/errata/RHSA-2026:5223 ADVISORY https://access.redhat.com/errata/RHSA-2026:5225 ADVISORY https://access.redhat.com/errata/RHSA-2026:5226 ADVISORY https://access.redhat.com/errata/RHSA-2026:5315 ADVISORY https://access.redhat.com/errata/RHSA-2026:5393 ADVISORY https://access.redhat.com/errata/RHSA-2026:5399 ADVISORY https://access.redhat.com/errata/RHSA-2026:5606 ADVISORY https://access.redhat.com/errata/RHSA-2026:5979 ADVISORY https://access.redhat.com/errata/RHSA-2026:6007 ADVISORY https://access.redhat.com/errata/RHSA-2026:6008 ADVISORY https://access.redhat.com/errata/RHSA-2026:6253 ADVISORY https://access.redhat.com/errata/RHSA-2026:6464 ADVISORY https://access.redhat.com/errata/RHSA-2026:7329 ADVISORY https://access.redhat.com/errata/RHSA-2026:8746 ADVISORY https://access.redhat.com/errata/RHSA-2026:8747 ADVISORY https://access.redhat.com/errata/RHSA-2026:8748 ADVISORY https://access.redhat.com/errata/RHSA-2026:8822 ADVISORY https://access.redhat.com/errata/RHSA-2026:8824 ADVISORY https://access.redhat.com/errata/RHSA-2026:9228 ADVISORY https://ubuntu.com/security/notices/USN-8018-3 ADVISORY https://vuldb.com/?id.342039 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0590/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0612/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0613/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0643/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0644/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0645/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0663/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0664/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0693/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0767/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20665/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20710/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22493/ REF https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1 REF https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45 REF https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2 REF https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d REF https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a REF https://github.com/python/cpython/issues/143921 REF https://github.com/python/cpython/pull/143922 REF https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy