A critical IMAP injection vulnerability in DirectoryTree ImapEngine allows authenticated attackers to execute arbitrary IMAP commands, potentially leading to unauthorized email access or account compromise.

The vulnerability is an injection flaw (CWE-74) stemming from improper neutralization of special characters in the id() function within ImapConnection.php. The flaw allows an authenticated attacker to inject quote or CRLF sequences into IMAP ID commands to manipulate mailbox operations.

The ability to execute arbitrary IMAP commands poses a significant risk to data confidentiality and integrity. An attacker could read or delete sensitive communications, terminate user sessions, or perform other unauthorized actions within the victim's mailbox. With a CVSS score of 7.6, this high-severity flaw represents a substantial threat to organizational email security and operational continuity.

Immediate Action: Update the directorytree/imapengine package to version 1.22.3 or later to incorporate the necessary input sanitization fixes.

Proactive Monitoring: Review application and IMAP server logs for anomalous command patterns, specifically looking for unexpected quote characters or CRLF sequences originating from the ImapEngine component.

Compensating Controls: Implement strict input validation at the application level before data is passed to the ImapEngine library to ensure no malicious control characters are present.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the provided GitHub Gist reference.

Given the availability of a public proof-of-concept and the potential for direct mailbox manipulation, this vulnerability should be prioritized for immediate remediation. Security teams must ensure that all instances of the affected package are updated to 1.22.3 immediately to prevent potential unauthorized access to sensitive email data.