{"id":"CVE-2026-123621","published":"2026-11-06T15:17:19.730","lastModified":"2026-11-06T18:18:04.240","description":"Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email attachments with ../ sequences in filenames, and when the recipient downloads all attachments, files like ~/.forward are overwritten, enabling command execution.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/webmin/usermin","tags":[]},{"url":"https://github.com/webmin/usermin/blob/2.570/mailbox/detachall.cgi#L43-L51","tags":[]},{"url":"https://github.com/webmin/usermin/commit/cb4614e8319e0932b10533a4d5606debf5f40e14","tags":[]},{"url":"https://github.com/webmin/usermin/issues/142","tags":[]},{"url":"https://hackmd.io/@leediay/H144QKY6zl","tags":[]},{"url":"https://www.vulncheck.com/advisories/usermin-through-2.570-path-traversal-file-write-via-detachall-cgi","tags":[]},{"url":"https://hackmd.io/@leediay/H144QKY6zl","tags":[]}],"exploitRefs":[{"url":"https://github.com/webmin/usermin","tags":[]},{"url":"https://github.com/webmin/usermin/blob/2.570/mailbox/detachall.cgi#L43-L51","tags":[]},{"url":"https://github.com/webmin/usermin/commit/cb4614e8319e0932b10533a4d5606debf5f40e14","tags":[]},{"url":"https://github.com/webmin/usermin/issues/142","tags":[]}],"hasPoc":true,"ai":{"summary":"Usermin versions up to 2.570 contain a path traversal flaw in the mailbox/detachall.cgi endpoint that allows unauthenticated attackers to write arbitrary files outside the intended temporary directory by embedding ../ sequences in attachment filenames. This enables overwriting critical files like ~/.forward, leading to remote command execution when mail is processed.","exploitability":"Exploitation requires an attacker to send a specially crafted email with malicious attachment filenames containing path traversal sequences and wait for the victim to download all attachments via the vulnerable endpoint; UI interaction by the victim is required per CVSS metrics.","blast_radius":"Successful exploitation grants remote command execution with the privileges of the Usermin service user, potentially compromising the entire host and enabling lateral movement within the mail infrastructure.","remediation":"Upgrade to Usermin 2.590 or later, which patches the path traversal vulnerability in mailbox/detachall.cgi.","detection":"Defenders should monitor web server access logs for requests to /mailbox/detachall.cgi with suspicious filename parameters containing %2e%2e%2f or ../ sequences, especially when accompanied by POST requests and non-standard attachment filenames. Additionally, watch for unexpected modifications to sensitive files like ~/.forward or .procmailrc in user home directories coinciding with such requests.","tags":["path-traversal","rce","webapp","mail-system","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:50:56.036Z"}}