CVE-2023-35169
CriticalCVSS 9.0Exploitation Probability (EPSS)
High risk84th percentile - higher than 84% of all known CVEs
Summary
PHP-IMAP prior to version 5.3.0 has a remote code execution vulnerability due to unsanitized attachment filenames. An attacker can exploit this vulnerability by sending a malicious attachment, leading to code execution on the server.
Risk Assessment
Organizations may be exposed to remote code execution, potentially leading to system takeover or data leakage. Applications that store attachments without proper sanitization are particularly at high risk.
Recommendation
It is recommended to upgrade to version 5.3.0 or later to patch this vulnerability. Additionally, ensure proper sanitization of attachment filenames before saving them.
Related vulnerabilities
- CVE-2026-86296Critical
A vulnerability was found in D-Link DIR-822A A_101 in the strcpy function of the file udhcpcd/serverpacket.c in the udhcpcd component. This manipulation causes a stack-based buffer overflow. The attack can be carried out remotely and the exploit is publicly disclosed.
- CVE-2026-79698Critical
A vulnerability was identified in Advantech WISE-6610 devices (multiple models) version 1.2.1_20251110 in the nodered_lib_apply function of the Node-RED Library component. Manipulation of the argument act leads to command injection. The attack can be launched remotely and the exploit is publicly available. The vendor released a fix in version 1.2.4_20260821.
- CVE-2026-79697Critical
A vulnerability was identified in Advantech WISE-6610 devices (multiple models) version 1.2.1_20251110 in the basicstation_apply function of the Basic Station Certificate-Deletion Handler component. Manipulation of the argument act causes command injection. The attack can be initiated remotely and the exploit is publicly disclosed. The vendor released a fix in version 1.2.4_20260821.
- CVE-2026-16876Critical
An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentication and execute arbitrary CLI commands by tampering with WebGUI messages and sending them to the device via internet.
- CVE-2026-86167Critical
A vulnerability was identified in Tenda HG10 (version 300001138) in the formgponConf function of the /boaform/admin/formgponConf file in the Boa component. Manipulation of the fmgpon_loid argument leads to OS command injection. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-86165Critical
A vulnerability was found in Tenda HG10 (version 300001138) in the formURL function of the /boaform/admin/formURL file. Manipulation of the Keywd/urlFQDN arguments results in a buffer overflow. The attack can be initiated remotely, and the exploit has been made public.
- CVE-2026-86218Critical
N-central is vulnerable to pre-auth remote code execution. This issue affects N-central before version 2026.3.1.14.
- CVE-2026-75816Critical
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to and including 3.29.12. The pre_update_value function lacks capability or ownership checks, and ActionPost::conditions_logic() short-circuits the current_user_can('edit_post') authorization gate when the post ID is non-numeric, allowing unauthenticated form submissions to be routed to arbitrary user records. This enables unauthenticated attackers to overwrite any user's email address, including an administrator's, and then use WordPress's native password-reset flow to take over the account.
- CVE-2026-16310Critical
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 1.8.5 via the 'id' parameter due to missing validation on a user-controlled key. This allows unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification to the victim.
- CVE-2026-86153Critical
A vulnerability has been found in Tenda CP3 (version 27.5.57.101) in the CRedirServer::SetRedirectEnable function of the Functions/Redirect.cpp file. The manipulation leads to improper privilege management. Remote exploitation is possible.
Original NVD description (English source)
PHP-IMAP is a wrapper for common IMAP communication without the need to have the php-imap module installed / enabled. Prior to version 5.3.0, an unsanitized attachment filename allows any unauthenticated user to leverage a directory traversal vulnerability, which results in a remote code execution vulnerability. Every application that stores attachments with `Attachment::save()` without providing a `$filename` or passing unsanitized user input is affected by this attack. An attacker can send an email with a malicious attachment to the inbox, which gets crawled with `webklex/php-imap` or `webklex/laravel-imap`. Prerequisite for the vulnerability is that the script stores the attachments without providing a `$filename`, or providing an unsanitized `$filename`, in `src/Attachment::save(string $path, string $filename = null)`. In this case, where no `$filename` gets passed into the `Attachment::save()` method, the package would use a series of unsanitized and insecure input values from the mail as fallback. Even if a developer passes a `$filename` into the `Attachment::save()` method, e.g. by passing the name or filename of the mail attachment itself (from email headers), the input values never get sanitized by the package. There is also no restriction about the file extension (e.g. ".php") or the contents of a file. This allows an attacker to upload malicious code of any type and content at any location where the underlying user has write permissions. The attacker can also overwrite existing files and inject malicious code into files that, e.g. get executed by the system via cron or requests. Version 5.3.0 contains a patch for this issue.