Usermin through 2.570 Path Traversal File Write via detachall.cgi

Advisories

Usermin through 2.570 Path Traversal File Write via detachall.cgi

Severity: high
Date: 11/6/2026
Affecting: usermin <= 2.570
CVE: CVE-2026-123621
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS: 8.6
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: GitHub Issue #142
https://github.com/webmin/usermin
Fix commit cb4614e
detachall.cgi attachment write
Researcher write-up
Credit: leediay153 from Viettel Post, Ilia Ross (iliaross)
Description: Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email attachments with ../ sequences in filenames, and when the recipient downloads all attachments, files like ~/.forward are overwritten, enabling command execution.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo