TI-2015-01866 Aliases CVE-2015-2079 GHSA-9wfx-p9gg-hp4f

Code injection in Usermin

HIGH 76CWE-96Published 2025-04-28 · Updated 2025-04-28

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01562 75th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Usermin (Usermin): 1.660

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Usermin	Usermin	0.980 to before 1.660	1.660	Patch available	CNA

Usermin VendorUsermin Affected 0.980 to before 1.660 Fixed in 1.660 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:webmin:usermin::::::::	0.980 to before 1.660	Vulnerable	Webmin

cpe:2.3:a:webmin:usermin:*:*:*:*:*:*:*:* Versions 0.980 to before 1.660 Vulnerable ·Webmin

Remediation

Fix · CNA Usermin (Usermin) Fixed in 1.660

Timeline

2026-10-02 Threatist record created from CVE-2015-2079
2026-10-03 Alias added: GHSA-9wfx-p9gg-hp4f

References

Exploit 1

https://code-white.com/blog/2015-05-cve-2015-2079-rce-usermin/

Advisory 1

https://code-white.com/public-vulnerability-list/

TI-2006-03290 Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before… CVSS 2.0MEDIUM 5.0
TI-2003-00096 miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly… CVSS 2.0HIGH 10.0
TI-2005-01115 Unknown vulnerability in (1) Webmin and (2) Usermin before 1.200 causes Webmin to change… CVSS 2.0HIGH 10.0
TI-2005-02873 miniserv.pl in Webmin before 1.230 and Usermin before 1.160, when "full PAM… CVSS 2.0HIGH 7.5
TI-2004-01345 The web mail functionality in Usermin 1.x and Webmin 1.x allows remote attackers to… CVSS 2.0HIGH 7.5
TI-2002-00734 (1) Webmin 0.96 and (2) Usermin 0.90 with password timeouts enabled allow local and… CVSS 2.0HIGH 7.5

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences