CVE-2025-15366: IMAP command injection in user-controlled commands
Deferred
AliasesALPINE-CVE-2025-15366RHSA-2026:5979UBUNTU-CVE-2025-15366DEBIAN-CVE-2025-15366CGA-22c2-ggw2-x8c7CGA-232h-86ff-rxm7CGA-26q2-45f4-w2r3CGA-28qc-w9ph-8hcpCGA-3wf5-mc2v-3252CGA-5jmx-v33j-c9v4CGA-fqhc-w2gg-fx34CGA-g97j-hvj9-46w3CGA-rwm4-x7jf-4cgxCGA-rxwq-r3v4-5ccwCGA-4x6g-cw77-rxqxCGA-h83p-r6v9-rp79
Published 20-01-2026Last modified 06-08-2026
Vulnerability summary
CVE-2025-15366 is a medium (CVSS 5.9) vulnerability in python software foundation cpython. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 37.5% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
5.9/10
010
Medium · v4.0 (CVE.org)EPSS score
0.43%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 51 · Related 25DLA-4455-1MGASA-2026-0455OPENSUSE-SU-2026:10152-1OPENSUSE-SU-2026:10200-1OPENSUSE-SU-2026:10206-1OPENSUSE-SU-2026:10221-1OPENSUSE-SU-2026:10222-1OPENSUSE-SU-2026:11342-1OPENSUSE-SU-2026:21595-1RHSA-2026:2128RHSA-2026:4165RHSA-2026:4168RHSA-2026:4216RHSA-2026:4463RHSA-2026:4473RHSA-2026:4713RHSA-2026:4746RHSA-2026:5152RHSA-2026:5215RHSA-2026:5216RHSA-2026:5218RHSA-2026:5219RHSA-2026:5221RHSA-2026:5223RHSA-2026:5225RHSA-2026:5226RHSA-2026:5315RHSA-2026:5393RHSA-2026:5399RHSA-2026:6007RHSA-2026:6008RHSA-2026:6253RHSA-2026:6464RHSA-2026:8822RHSA-2026:8824RHSA-2026:9228SUSE-SU-2026:0590-1SUSE-SU-2026:0612-1SUSE-SU-2026:0613-1SUSE-SU-2026:0643-1SUSE-SU-2026:0644-1SUSE-SU-2026:0645-1SUSE-SU-2026:0663-1SUSE-SU-2026:0664-1SUSE-SU-2026:0693-1SUSE-SU-2026:0767-1SUSE-SU-2026:20665-1SUSE-SU-2026:20710-1SUSE-SU-2026:23159-1SUSE-SU-2026:23303-1SUSE-SU-2026:3649-1CGA-7P22-P3HV-6Q3WUSN-8018-1USN-8018-2
Timeline
- 20-01-2026PublishedVulnerability first disclosed.
- 06-08-2026Last modifiedVulnerability information updated.
Description
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
CVSS metrics
8 scores · 8 sources · 2 versionsMedium 5.9Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:NSourcesAll 7 agree
- OSV · AlpineEcosystem advisory · calculated5.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated5.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated5.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
- NVDNIST5.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.1Preferred score · OSV · Red hat (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:NSourcesSingle source
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.42% on 05-10-2026
05-10-202604-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu12 products
- python2.7All versions (No fix recorded)
- python3.10All versions (No fix recorded)
- python3.11All versions (No fix recorded)
- python3.12All versions (No fix recorded)
- python3.13All versions (No fix recorded)
Redhat9 products
- python3.13< 0:3.13.12-2.hum1
- python3.13-debug< 0:3.13.12-2.hum1
- python3.13-devel< 0:3.13.12-2.hum1
- python3.13-freethreading< 0:3.13.12-2.hum1
- python3.13-freethreading-debug< 0:3.13.12-2.hum1
Chainguard6 products
- python-3.10All versions (No fix recorded)
- python-3.11All versions (No fix recorded)
- python-3.12All versions (No fix recorded) | < 3.12.16-r2
- python-3.13< 3.13.15-r0
- python-3.14< 3.14.7-r0
Debian5 products
- jythonAll versions (No fix recorded)
- pypy3All versions (No fix recorded)
- python3.11All versions (No fix recorded)
- python3.13All versions (No fix recorded)
- python3.14All versions (No fix recorded) | < 3.14.7-1
Wolfi5 products
- python-3.10All versions (No fix recorded)
- python-3.11All versions (No fix recorded)
- python-3.12All versions (No fix recorded) | < 3.12.16-r2
- python-3.13< 3.13.15-r0
- python-3.14< 3.14.7-r0
Alpine1 product
- python3< 3.14.7-r0
Python software foundation1 product
- cpython< 3.13.15 | ≥ 3.14.0, < 3.14.7 | ≥ 3.15.0a1, < 3.15.0a6
7 vendors · 39 products
References
24 links- mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/Vendor AdvisoryARTICLEREPORTAdvisory
Show all 24 references
- images.redhat.comARTICLE
- github.com/python/cpythonPACKAGE