CVE-2026-123621 · Runtime
NO FIX YET · SEE WHAT TO DO
Usermin through 2.570 fails to sanitize attachment filenames in mailbox/detachall.cgi, so path traversal sequences like ../ write files outside the temporary directory. An unauthenticated attacker who emails a crafted attachment can overwrite files such as ~/.forward when the recipient downloads all attachments, enabling command execution.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Servers running Usermin through 2.570 with the mailbox module are exposed, because mail sent to a mailbox user can reach the vulnerable download path. Systems where Usermin is not installed, or where the mailbox module is not in use, can skip it. Whether an attacker needs access beyond sending mail is unknown from the sources.
Not affected if mailbox-module-disabled, usermin-not-installed
Who cares email, self-hosted, usermin, webmin
usermin -v or the package manager, and compare it to the fixed range in the product data.Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email attachments with ../ sequences in filenames, and when the recipient downloads all attachments, files like ~/.forward are overwritten, enabling command execution.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.