{"id":"CVE-2026-123621","summary":"Usermin through 2.570 Path Traversal File Write via detachall.cgi","details":"Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email attachments with ../ sequences in filenames, and when the recipient downloads all attachments, files like ~/.forward are overwritten, enabling command execution.","modified":"2026-11-08T02:47:31.683606270Z","published":"2026-11-06T15:00:56.411Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123621.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123621.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123621"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/usermin-through-2.570-path-traversal-file-write-via-detachall-cgi"},{"type":"REPORT","url":"https://github.com/webmin/usermin/issues/142"},{"type":"FIX","url":"https://github.com/webmin/usermin/commit/cb4614e8319e0932b10533a4d5606debf5f40e14"},{"type":"PACKAGE","url":"https://github.com/webmin/usermin"},{"type":"ARTICLE","url":"https://github.com/webmin/usermin/blob/2.570/mailbox/detachall.cgi#L43-L51"},{"type":"ARTICLE","url":"https://hackmd.io/@leediay/H144QKY6zl"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/webmin/usermin","events":[{"introduced":"0"},{"fixed":"cb4614e8319e0932b10533a4d5606debf5f40e14"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"last_affected":"2.570"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"cb4614e8319e0932b10533a4d5606debf5f40e14"}]}]}}],"versions":["2.570","2.560","2.552","2.551","2.550","2.540","2.530","2.521","2.520","2.510","2.500","2.420","2.400","2.302","2.301","2.300","2.203","2.202","2.201","2.200","2.102","2.100","2.010","2.005","2.004","2.003","2.002","2.001","2.000","1.861","1.860","1.854","1.853","1.852","1.851","1.850","1.841","1.840","1.834","1.833","1.832","1.830","1.823","1.820","1.812","1.810","1.803"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-123621.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}