CVE-2018-19518: exploitation status and patch state

CVE-2018-19518 · CVSS 7.5 HIGH · EPSS 95%

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.

Is CVE-2018-19518 exploited?

• Not in the CISA KEV catalog.
• EPSS puts exploitation in the next 30 days at 95%.

Which products and versions are affected?

• php · php · >= 5.6.0, <= 5.6.38, >= 7.0.0, <= 7.0.32, >= 7.1.0, <= 7.1.24, >= 7.2.0, <= 7.2.12
• debian · debian linux · 8.0, 9.0
• uw-imap project · uw-imap · 2007f
• canonical · ubuntu linux · 16.04, 18.04, 19.04

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2018-19518

• CISA Flags Fuel-Boss Shared PHP Exposure (2026-08-27)

Primary sources

• NVD record

What this record does not say

• No patch identifier.
• No exploit assessment.

KEV and EPSS are re-checked daily. Record last updated 2026-08-27.