Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands. This allows attackers to read or delete victim's emails, terminate the victim's session or execute any valid IMAP command on victim's mailbox by including quote characters " or CRLF sequences \r\n in the input.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-02-14 | 2 | Disclosure2 |
| 2026-02-17 | 1 | Disclosure1 |
CVE-2026-2469 Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('… https://www.cve.org/CVERecord?id=CVE-2026-2469
Post summary
The text reports that directorytree/imapengine versions before 1.22.3 are vulnerable to improper neutralization of special elements, but it provides no details on PoC, exploitation, or mitigation.
⚡ New CVE Alert: CVE-2026-2469 📊 Severity: 7.6 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-2469 #CVE-2026-2469 #CVE #High #CyberSecurity #InfoSec https://t.co/yMJjtenu5R
Post summary
The post announces the new CVE-2026-2469 vulnerability with a severity of 7.6 and high risk level, noting it affects multiple unspecified products; no PoC, exploit, or patch information is provided.
CVE-2026-2469: Return to Sender: Unauthenticated IMAP Command Injection in directorytree/imapengine A critical failure in input sanitization within the `directorytree/imapengine` PHP library allows attackers to perform IMAP Command Injection. By manip... https://cvereports.com/reports/CVE-2026-2469
Post summary
The post announces a critical IMAP Command Injection vulnerability in the directorytree/imapengine PHP library, detailing the sanitization flaw but providing no PoC, exploit code, patch, or exploitation evidence.