Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-123621: Usermin lets attackers overwrite files via crafted email attachments
CVE-2026-123621 · published 3 days ago
Summary
Usermin versions up to 2.570 let a remote sender attach files whose names contain directory tricks (like "../"). When the recipient downloads all attachments, those tricked names cause the system to write files outside the intended folder, overwriting important files such as the mail forwarding configuration and potentially running attacker commands. To protect yourself, update Usermin to a version that fixes this issue or disable the feature that automatically downloads all attachments.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| webmin | usermin | <= 2.570 |
Original advisory text
Usermin through 2.570 Path Traversal File Write via detachall.cgi
Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email attachments with ../ sequences in filenames, and when the recipient downloads all attachments, files like ~/.forward are overwritten, enabling command execution.
References
- https://github.com/webmin/usermin Product
- https://github.com/webmin/usermin/blob/2.570/mailbox/detachall.cgi#L43-L51 Third Party Advisory
- https://github.com/webmin/usermin/commit/cb4614e8319e0932b10533a4d5606debf5f40e1... Patch
- https://github.com/webmin/usermin/issues/142 Third Party Advisory
- https://hackmd.io/@leediay/H144QKY6zl Third Party Advisory
- https://www.vulncheck.com/advisories/usermin-through-2.570-path-traversal-file-w... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-1236... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-123621 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.9
Critical
Type
CWE-22Path Traversal
Timeline
Published6 Nov 2026
Updated7 Nov 2026
First seen6 Nov 2026
Track software like this
Free during beta