CVE-2026-123621

EUVD-2026-118297
Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email attachments with ../ sequences in filenames, and when the recipient downloads all attachments, files like ~/.forward are overwritten, enabling command execution.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
webminusermin
𝑥
≤ 2.570
CNA
Common Weakness Enumeration
References
https://github.com/webmin/usermin
https://github.com/webmin/usermin/blob/2.570/mailbox/detachall.cgi#L43-L51
https://github.com/webmin/usermin/commit/cb4614e8319e0932b10533a4d5606debf5f40e14
https://github.com/webmin/usermin/issues/142
https://hackmd.io/@leediay/H144QKY6zl
https://www.vulncheck.com/advisories/usermin-through-2.570-path-traversal-file-write-via-detachall-cgi
https://hackmd.io/@leediay/H144QKY6zl