CVE-2025-15366

Aliases:RHSA-2026:5979UBUNTU-CVE-2025-15366DEBIAN-CVE-2025-15366ALPINE-CVE-2025-15366CGA-22c2-ggw2-x8c7CGA-232h-86ff-rxm7CGA-26q2-45f4-w2r3CGA-28qc-w9ph-8hcpCGA-3wf5-mc2v-3252CGA-5jmx-v33j-c9v4CGA-fqhc-w2gg-fx34CGA-g97j-hvj9-46w3CGA-4x6g-cw77-rxqxCGA-h83p-r6v9-rp79CGA-rwm4-x7jf-4cgxCGA-rxwq-r3v4-5ccw
Advisory lineage Upstream: 0 Downstream: 54
Deferred
Published: 20 Jan 2026, 21:40
Last modified:06 Aug 2026, 00:37

Vulnerability Summary

Overall Risk (default)
low
24/100
CVSS Score
5.9 MEDIUM
v4.0 (cve.org)
EPSS Score
0.42% LOW
0% probability +0.34%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

20 Jan 2026, 21:40
Published
Vulnerability first disclosed
06 Aug 2026, 00:37
Last Modified
Vulnerability information updated

Description

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

CVSS Metrics

  • v4.0•MEDIUM•Score: 5.9CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
  • v4.0•MEDIUM•Score: 5.9CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•HIGH•Score: 7.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

EPSS Trends

Current EPSS score: 0.42%• Percentile: 36%

Techniques & Countermeasures

  • CWE-77•Improper Neutralization of Special Elements used in a Command ('Command Injection')

    The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Affected Systems

  • alpine•python3

    < 3.14.7-r0

  • chainguard•python-3.10

    all

  • chainguard•python-3.11

    all

  • chainguard•python-3.12

    all

  • chainguard•python-3.13

    < 3.13.15-r0

  • chainguard•python-3.14

    < 3.14.7-r0

  • chainguard•python-3.9

    all

  • wolfi•python-3.10

    all

  • wolfi•python-3.11

    all

  • wolfi•python-3.12

    all

  • wolfi•python-3.13

    < 3.13.15-r0

  • wolfi•python-3.14

    < 3.14.7-r0

  • debian•jython

    all | all | all | all

  • debian•pypy3

    all | all | all | all

  • debian•python2.7

    all

  • debian•python3.11

    all

  • debian•python3.13

    all | all

  • debian•python3.14

    all

  • debian•python3.9

    all

  • ubuntu•python2.7

    all | all

  • ubuntu•python3.10

    all

  • ubuntu•python3.11

    all

  • ubuntu•python3.12

    all

  • ubuntu•python3.13

    all

  • ubuntu•python3.14

    all

  • ubuntu•python3.4

    all

  • ubuntu•python3.5

    all

  • ubuntu•python3.6

    all

  • ubuntu•python3.7

    all

  • ubuntu•python3.8

    all

  • ubuntu•python3.9

    all

  • python software foundation•cpython

    < 3.15.0 | < 3.15.0a6 | < 3.13.15 | ≥ 3.14.0, < 3.14.7 | ≥ 3.15.0a1, < 3.15.0a6

  • redhat•python3.13

    < 0:3.13.12-2.hum1

References (24)