Read the docs
TI-2026-85960 Aliases CVE-2026-123622GHSA-pqrp-xhqp-wc9w

Cross-site scripting in Usermin mailbox detach.cgi

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Usermin through 2.570 contains a cross-site scripting flaw in mailbox/detach.cgi caused by improper neutralization of input (CWE-79). A remote attacker can email an HTML attachment containing script and lure a user to a detach.cgi link with an arbitrary type parameter that bypasses JavaScript filtering, which runs the script in the victim's authenticated Usermin session.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Usermin through 2.570 contains a cross-site scripting vulnerability in mailbox/detach.cgi that allows remote attackers to execute script by supplying an arbitrary type parameter that bypasses JavaScript filtering. Attackers can email an HTML attachment containing script and lure recipients to a detach.cgi link with type=text/html to run script in the victim's authenticated Usermin session.

Why it matters now

EPSS 0.00259 17th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Webminuserminup to 2.570—No fix listedCNA
  • usermin VendorWebmin Affected up to 2.570 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Usermin.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-123622
  2. 2026-11-06 Alias added: GHSA-pqrp-xhqp-wc9w

References

Patch 1

Other 4

  • TI-2019-11278 An issue was discovered in Webmin <=1.920. KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-16770 software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command. CVSS 3.1CRITICAL 9.8
  • TI-2022-00731 Improper Access Control to Remote Code Execution in webmin/webmin CVSS 3.1HIGH 8.8
  • TI-2019-09619 In Webmin through 1.910, any user authorized to the "Package Updates" module can execute… CVSS 3.0HIGH 8.8
  • TI-2015-01866 Code injection in Usermin CVSS 3.1CRITICAL 9.9
  • TI-2022-15852 Usermin through 1.850 allows a remote authenticated user to execute OS commands via… CVSS 3.1HIGH 8.8
See all 121 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences