CVE-2018-19518: PHP imap_open argument injection enables OS command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote command execution with a very high EPSS score and public exploit code, though exploitation requires attacker-controlled IMAP server input and a specific rsh-to-ssh configuration.

What it is

The University of Washington IMAP Toolkit (2007f) used by PHP's imap_open() launches an rsh command without preventing argument injection. When the IMAP server name is attacker-controlled input, a crafted value can inject arguments into that command. On systems where rsh is a link to ssh, such as Debian and Ubuntu, the injected -oProxyCommand argument can lead to arbitrary OS command execution.

Impact

An attacker who controls the IMAP server name passed to imap_open() can execute arbitrary operating system commands under the web or application process account. This can lead to full compromise of the host and any data or credentials reachable from that process.

Attack surface

Reached remotely over the network through any application that passes untrusted input as the IMAP server name to imap_open(); the CVSS vector indicates network access with low privileges and no user interaction. Exploitation depends on the environment, specifically rsh being replaced by a program such as ssh with different argument semantics.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.9523 (99.862nd percentile), and multiple references are tagged Exploit, including public proof-of-concept code and an Exploit-DB entry, indicating mature public exploitation.

What to do

• Patch PHP and the underlying UW IMAP Toolkit to fixed versions; apply the vendor commits and distribution advisories referenced for Debian, Ubuntu and Gentoo.
• Upgrade or remove PHP versions that still bundle the vulnerable c-client code, and confirm the fix is present after upgrade.
• Do not pass user-controlled values directly as the IMAP server name to imap_open(); validate against a strict allowlist of known hosts.
• On affected hosts, ensure rsh is not a link to ssh or otherwise present with unexpected argument semantics, and remove unnecessary rsh/ssh client binaries from the web server environment.
• Restrict outbound network access from application servers so injected proxy commands cannot reach external hosts.

Detection

• Search application code and logs for imap_open() calls where the server argument derives from request parameters, and review for values containing -oProxyCommand or other option-like strings.
• Monitor web and application process trees for unexpected child processes such as rsh or ssh spawned by the web server user.
• Alert on outbound connections from web or application servers to unusual destinations consistent with injected proxy commands.
• Audit installed PHP and UW IMAP package versions against the fixed releases named in the vendor advisories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.