Read the docs
TI-2026-85959 Aliases CVE-2026-123621GHSA-6rhc-3jj8-rcqx

Path traversal in Usermin detachall.cgi lets attackers write files

Priority LOW 39CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Usermin through 2.570 contains a path traversal flaw in mailbox/detachall.cgi. Unsanitized attachment filenames let a remote unauthenticated attacker write files outside the temporary directory. When a recipient downloads all attachments, files such as ~/.forward are overwritten, which enables command execution. Exploitation requires the recipient to download the attachments (CWE-22).

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email attachments with ../ sequences in filenames, and when the recipient downloads all attachments, files like ~/.forward are overwritten, enabling command execution.

Why it matters now

EPSS 0.00984 62nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Webminuserminup to 2.570—No fix listedCNA
  • usermin VendorWebmin Affected up to 2.570 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Usermin.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-123621
  2. 2026-11-06 Alias added: GHSA-6rhc-3jj8-rcqx
  3. 2026-11-08 Priority changed: MEDIUM → LOW

References

Patch 1

Other 4

  • TI-2019-11278 An issue was discovered in Webmin <=1.920. KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-16770 software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command. CVSS 3.1CRITICAL 9.8
  • TI-2022-00731 Improper Access Control to Remote Code Execution in webmin/webmin CVSS 3.1HIGH 8.8
  • TI-2019-09619 In Webmin through 1.910, any user authorized to the "Package Updates" module can execute… CVSS 3.0HIGH 8.8
  • TI-2015-01866 Code injection in Usermin CVSS 3.1CRITICAL 9.9
  • TI-2022-15852 Usermin through 1.850 allows a remote authenticated user to execute OS commands via… CVSS 3.1HIGH 8.8
See all 121 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences