CVE-2025-15367 MEDIUM

CVE-2025-15367: POP3 command injection in user-controlled commands

Vendor Python Software Foundation

Product CPython

Weakness CWE-77

Published January 20, 2026

Last update February 26, 2026

View on NVD All CVEs

CVSS base score

5.9/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

Key dates

02Disclosure timeline

January 20, 2026 CVE published

February 26, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-15367 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/77.html

Related vulnerabilities

04Related CVE

CVE-2026-3943 H3C ACG1000-AK230 aaa_portal_auth_local_submit command injection CVE-2026-3517 OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF CVE-2019-1784 Cisco NX-OS Software Command Injection Vulnerability CVE-2024-5035 TP-Link Archer C5400X - RFTest Unauthenticated Command Injection CVE-2025-4122 Netgear JWNR2000v2 sub_435E04 command injection