CVE-2026-123621— Usermin through 2.570 Path Traversal File Write via detachall.cgi

Quick assessment

Affected

webmin usermin

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Usermin 2.570 及更早版本在 mailbox/detachall.cgi 组件中存在路径遍历漏洞。该漏洞允许远程未认证攻击者通过未过滤的附件文件名，将文件写入临时目录之外。攻击者可发送文件名中包含 "../" 序列的邮件附件；当收件人下载所有附件时，诸如 ~/.forward 等文件可能被覆盖，从而为攻击者提供命令执行能力。

CVSS 8.8 · High Updated Nov 07, 2026

Possible ATT&CK Techniques 2 AI

T1083 · File and Directory Discovery T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Usermin through 2.570 Path Traversal File Write via detachall.cgi

Source: CVE Program / CVE List V5

Vulnerability Description

Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email attachments with ../ sequences in filenames, and when the recipient downloads all attachments, files like ~/.forward are overwritten, enabling command execution.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
webmin	usermin	0 ~ 2.570	-

II. Public POCs for CVE-2026-123621

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123621

请登录查看更多情报信息。

Other References for CVE-2026-123621 (6)

https://github.com/webmin/usermin product
https://github.com/webmin/usermin/issues/142 issue-tracking
https://github.com/webmin/usermin/commit/cb4614e8319e0932b10533a4d5606debf5f40e14 patch
https://hackmd.io/@leediay/H144QKY6zl technical-description
https://github.com/webmin/usermin/blob/2.570/mailbox/detachall.cgi#L43-L51 technical-description
https://www.vulncheck.com/advisories/usermin-through-2.570-path-traversal-file-write-via-detachall-cgi third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123621

Same Patch Batch · webmin · 2026-11-06 · 3 CVEs total

CVE-2026-123620	7.5 HIGH	Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion
CVE-2026-123622	6.1 MEDIUM	Usermin through 2.570 XSS via mailbox detach.cgi type Parameter

IV. Related Vulnerabilities

Same product: usermin

Same vendor: webmin

Same weakness: CWE-22