CVE-2026-123621: Usermin through 2.570 Path Traversal File Write via detachall.cgi

Published Nov 6, 2026

Updated

Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email attachments with ../ sequences in filenames, and when the recipient downloads all attachments, files like ~/.forward are overwritten, enabling command execution.

Event History

Nov 6, 2026

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required for exploitation?

An attacker must be able to send an email with attachment filenames containing ../ sequences to a Usermin user. Exploitation is triggered when that recipient uses the download-all-attachments function handled by mailbox/detachall.cgi.

Who is exposed to command execution risk?

Usermin users who receive attacker-controlled email attachments and download all attachments are exposed. The described impact includes overwriting files such as ~/.forward, which can enable command execution.

How can I determine whether exploitation may have occurred?

Review received messages for attachments with filenames containing ../ sequences, particularly for users who downloaded all attachments. Also inspect affected users' files outside the temporary directory, including ~/.forward, for unexpected overwrites.

CVE-2026-123621: Usermin through 2.570 Path Traversal File Write via detachall.cgi

Event History

Frequently Asked Questions

What conditions are required for exploitation?

Who is exposed to command execution risk?

How can I determine whether exploitation may have occurred?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

Who is exposed to command execution risk?

How can I determine whether exploitation may have occurred?