CVE-2026-123621

Summary

Usermin versions up to 2.570 contain a path traversal flaw in the mailbox/detachall.cgi endpoint that allows unauthenticated attackers to write arbitrary files outside the intended temporary directory by embedding ../ sequences in attachment filenames. This enables overwriting critical files like ~/.forward, leading to remote command execution when mail is processed.

Exploitability

Exploitation requires an attacker to send a specially crafted email with malicious attachment filenames containing path traversal sequences and wait for the victim to download all attachments via the vulnerable endpoint; UI interaction by the victim is required per CVSS metrics.

Blast radius

Successful exploitation grants remote command execution with the privileges of the Usermin service user, potentially compromising the entire host and enabling lateral movement within the mail infrastructure.

Detection

Defenders should monitor web server access logs for requests to /mailbox/detachall.cgi with suspicious filename parameters containing %2e%2e%2f or ../ sequences, especially when accompanied by POST requests and non-standard attachment filenames. Additionally, watch for unexpected modifications to sensitive files like ~/.forward or .procmailrc in user home directories coinciding with such requests.

Prioritized remediation

Upgrade to Usermin 2.590 or later, which patches the path traversal vulnerability in mailbox/detachall.cgi.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.