CVE-2025-15366

Medium

Advisory

Published 20 Jan 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.9; base score, highest
EPSS: 0.004; 32nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 664; of 17,781 indexed, latest versions
Container images: 652; deployed by those charts
Fix available: 12 of 16; affected packages

IMAP command injection in user-controlled commands

Carried by container images the latest versions of 664 of 17,781 indexed charts deploy, on 652 images.

Affected package	Affected versions	Fixed in	Images
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+6 more	3.11.0~rc1-1~22.04.1~esm9	181
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	3.8.10-0ubuntu1~20.04.18+esm6	100
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+11 more	3.12.3-1ubuntu0.12	89
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+16 more	3.10.12-1~22.04.15	80
python3.13deb	3.13.5-2, 3.13.5-2+deb13u2, 3.13.5-2+deb13u4, 3.13.7-1ubuntu0.1	3.13.7-1ubuntu0.4	74
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+12 more	no fix listed	54
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	3.6.9-1~18.04ubuntu1.13+esm9	44
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	3.5.2-2ubuntu0~16.04.13+esm22	25
python3apk	3.12.12-r0, 3.14.3-r0, 3.14.5-r0, 3.14.5-r1	3.14.7-r0	12
python-3.12apk	3.12.0-r1, 3.12.9-r1, 3.12.14-r2, 3.12.14-r6	no fix listed	8
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	3.4.3-1ubuntu1~14.04.7+esm20	7
python-3.14apk	3.14.2-r2, 3.14.4-r2, 3.14.6-r0	3.14.7-r0	6
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	3.15.0	3
python-3.13apk	3.13.7-r0, 3.13.10-r0, 3.13.12-r2	3.13.15-r0	3
python-3.11apk	3.11.16-r5	no fix listed	1
python3rpm	3.12.9-13.azl3	no fix listed	1

OSV records: ALPINE-CVE-2025-15366 BIT-python-2025-15366 CGA-22c2-ggw2-x8c7 CGA-232h-86ff-rxm7 CGA-26q2-45f4-w2r3 CGA-fqhc-w2gg-fx34 DEBIAN-CVE-2025-15366 UBUNTU-CVE-2025-15366 AZL-75029
Also known as: BIT-libpython-2025-15366, BIT-python-min-2025-15366, CGA-28qc-w9ph-8hcp, CGA-3wf5-mc2v-3252, CGA-5jmx-v33j-c9v4, CGA-g97j-hvj9-46w3, PSF-2026-3, USN-8018-1, USN-8018-2

Charts affected

664 by stars

Chart

Latest

Affected images

Radar Score

calibre-webvista

0.1.3

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2025-15366.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.12

Open the chart page →

7,628

aih-scannerwallarm

2.7.11

1 of 2 See more

aih-scanner wallarm 2.7.11

1 of the 2 container images this version deploys carry CVE-2025-15366.

Container image	Digest	Package	Fixed in
wallarm/aih-scanner :2.7.11	f1cb26db1f5b	python3.13@3.13.5-2+deb13u4	no fix listed

Open the chart page →

3,911

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2025-15366.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm6

Open the chart page →

11,119

myweatherhelmwebapp1

1.3.50

2 of 8 See more

myweatherhelm webapp1 1.3.50

2 of the 8 container images this version deploys carry CVE-2025-15366.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.12
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	3.8.10-0ubuntu1~20.04.18+esm6

Open the chart page →

9,130

myweatherhelm-schedulingwebapp1

1.3.92

2 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

2 of the 9 container images this version deploys carry CVE-2025-15366.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.12
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	3.8.10-0ubuntu1~20.04.18+esm6

Open the chart page →

9,130

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2025-15366.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm6

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2025-15366.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm6

Open the chart page →

28,605

argocd-image-updaterwenerme

1.3.1

1 of 1 See more

argocd-image-updater wenerme 1.3.1

1 of the 1 container images this version deploys carry CVE-2025-15366.

Container image	Digest	Package	Fixed in
quay.io/argoprojlabs/argocd-image-updater :v1.3.0	cb009167015c	python3@3.14.5-r0	3.14.7-r0

Open the chart page →

718

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2025-15366.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	python3.6@3.6.9-1~18.04ubuntu1.1	3.6.9-1~18.04ubuntu1.13+esm9

Open the chart page →

10,843

juicefs-csi-driverwenerme

0.32.5

1 of 5 See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2025-15366.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.32.5	95008ba63318	python3.11@3.11.2-6+deb12u8	no fix listed

Open the chart page →

9,117

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2025-15366.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm6

Open the chart page →

15,230

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2025-15366.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.15

Open the chart page →

9,248

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-15366.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.15

Open the chart page →

14,100

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2025-15366.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	python3.10@3.10.12-1~22.04.16	no fix listed

Open the chart page →

7,849

Container images carrying it

652 by charts deploying them

A fixed version is listed for 12 of the 16 affected packages.

Container image	Digest	Package	Fixed in	Used by
archivebox/archivebox :0.7.4	1a5a37331091	python3.11@3.11.2-6+deb12u7	no fix listed	1
artur9010/wait-for :v1.0.0	6b4de3ce8b0e	python3.11@3.11.2-6	no fix listed	1
arunvelsriram/utils :latest	655ad18fd8d6	python3.12@3.12.3-1ubuntu0.7	3.12.3-1ubuntu0.12	1
assistiot/cybersecurity-monitoring_ir-cas :latest	6a107f224c34	python2.7@2.7.18-1~20.04.3	no fix listed	1
assistiot/open_api_backend :1.1.2	30812ba93555	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.15	1
assistiot/smart-orchestrator_mcs :latest	7d6a0d534c7f	python3.11@3.11.2-6	no fix listed	1
assistiot/smart-orchestrator_scheduler :latest	38b003e55ff3	python3.11@3.11.2-6	no fix listed	1
assistiot/smart-orchestrator_scheduler_mc :latest	b1dbe4d62a03	python3.11@3.11.2-6	no fix listed	1
assistiot/video_augmentation :runner-cpu-latest	e5ae539ce2cb	python3.8@3.8.10-0ubuntu1~20.04.7	3.8.10-0ubuntu1~20.04.18+esm6	1
atlassian/bamboo :12.1.11	4af4bb6c8d46	python3.12@3.12.3-1ubuntu0.16	no fix listed	1
atlassian/bamboo-agent-base :12.1.11	51c2d7274eef	python3.12@3.12.3-1ubuntu0.16	no fix listed	1
atlassian/bitbucket :10.2.7	05933f2b1cfd	python3.12@3.12.3-1ubuntu0.16	no fix listed	1
atlassian/confluence-server :7.10.0	3b9222ab32ef	python3.10@3.10.6-1~22.04.1	3.10.12-1~22.04.15	1
atlassian/crowd :7.2.3	c81cc7d6bc9e	python3.12@3.12.3-1ubuntu0.16	no fix listed	1
atlassian/crowd :5.2.2	ebf761c7d437	python3.12@3.12.3-1ubuntu0.16	no fix listed	1
atlassian/jira-software :8.14.0	37bc46cbec1a	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.15	1
atlassian/jira-software :9.7.2	64a75aa4ec4e	python3.12@3.12.3-1ubuntu0.5	3.12.3-1ubuntu0.12	1
atlassian/jira-software :11.3.11	e5548cd4eea8	python3.12@3.12.3-1ubuntu0.16	no fix listed	1
avinash263/pyredis263 :latest	aa2b8727f1a6	python3.11@3.11.2-6	no fix listed	1
baserow/backend :1.31.1	e0b3c8130b91	python3.11@3.11.2-6+deb12u5	no fix listed	1
baserow/baserow :1.30.1	df0c42eb67e8	python3.11@3.11.2-6+deb12u4	no fix listed	1
bbernhard/signal-cli-rest-api :0.57	549ad08d7e14	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm6	1
beanbag/reviewboard :latest	6b840f546e1c	python3.10@3.10.12-1~22.04.17 python3.11@3.11.0~rc1-1~22.04.1	no fix listed no fix listed	1
beyzkaya/blog-backend :v1.0.1	12a6a3d1c5f9	python3.11@3.11.2-6+deb12u6	no fix listed	1
bicarus/elrond-rosetta :v1.3.50.0	b1dab0721e1c	python3.8@3.8.10-0ubuntu1~20.04.6	3.8.10-0ubuntu1~20.04.18+esm6	1
bitnamilegacy/cassandra :4.1.7-debian-12-r3	2b7a217999a1	python@3.11.11-0	3.15.0	1
blakeblackshear/frigate :0.10.0-amd64	ae269270ad9e	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm6	1
bloxstaking/ssv-node :v2.2.0	bf6d7d2fdc93	python3.11@3.11.2-6+deb12u5	no fix listed	1
bnjbvr/kresus :0.22.1	37e216b182c8	python3.11@3.11.2-6+deb12u4	no fix listed	1
boky/postfix :5.1.0	aafc77238423	python3.13@3.13.5-2	no fix listed	1
boky/postfix :4.4.0	f3f247fd4252	python3.11@3.11.2-6+deb12u5	no fix listed	1
browserless/chrome :1.48.0-chrome-stable	c81ae5585b47	python3.8@3.8.10-0ubuntu1~20.04	3.8.10-0ubuntu1~20.04.18+esm6	1
byjg/easy-haproxy :6.1.1	230fdb7b00ae	python3@3.14.5-r0	3.14.7-r0	1
camptocamp/mapserver :latest	bf2e8e118c9b	python3.12@3.12.3-1ubuntu0.16	no fix listed	1
carlosmz87/test_helm_backend :latest	8ffa63aa995d	python3.11@3.11.2-6+deb12u4	no fix listed	1
castopod/castopod :1.12.10	1fd37280cbb2	python3.11@3.11.2-6+deb12u3	no fix listed	1
cccs/assemblyline-rust :4.7.4.stable17	468326853ec5	python3.11@3.11.2-6+deb12u8	no fix listed	1
checkmk/check-mk-community :2.5.0p6	c11b422210c4	python3.10@3.10.12-1~22.04.15	no fix listed	1
chetangautamm/repo :Opensips_Build	b4b94155ff5a	python3.4@3.4.3-1ubuntu1~14.04.7	3.4.3-1ubuntu1~14.04.7+esm20	1
chetangautamm/repo :sipp.v3	e7f7049e1544	python3.8@3.8.5-1~20.04	3.8.10-0ubuntu1~20.04.18+esm6	1
cheyang/distributed-tf :1.6.0	46cc34755493	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	no fix listed 3.5.2-2ubuntu0~16.04.13+esm22	1
chiefonboarding/chiefonboarding :v2.4.1	59bc7aa60fe7	python3.13@3.13.5-2	no fix listed	1
chocobozzz/peertube :v8.1.5	052712130691	python3.13@3.13.5-2+deb13u2	no fix listed	1
chriseaton/adventureworks :latest	54c3384ce701	python3.10@3.10.12-1~22.04.9	3.10.12-1~22.04.15	1
citizenstig/httpbin :latest	b81c818ccb86	python3.5@3.5.2-2ubuntu0~16.04.1	3.5.2-2ubuntu0~16.04.13+esm22	1
cloudve/janis-terminal :latest	af56e77ca587	python3.6@3.6.9-1~18.04ubuntu1	3.6.9-1~18.04ubuntu1.13+esm9	1
cloudve/ttyd :latest	d79c1c5881c0	python3.6@3.6.9-1~18.04ubuntu1	3.6.9-1~18.04ubuntu1.13+esm9	1
codedesignplus/ms-emails-grpc :latest	e336012bc781	python3.11@3.11.2-6+deb12u8	no fix listed	1
codedesignplus/ms-emails-rest :latest	ac84661c605e	python3.11@3.11.2-6+deb12u8	no fix listed	1
countly/countly-server :25.05.4	e3c238248f99	python2.7@2.7.18-1~20.04.4 python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed 3.8.10-0ubuntu1~20.04.18+esm6	1