Path Traversal Vulnerability in Usermin Affects Webmin

CVE-2026-123621

What is CVE-2026-123621?

Usermin, a web-based mail interface, is susceptible to a path traversal vulnerability in the 'detachall.cgi' component. This flaw enables remote unauthenticated attackers to save files outside the intended temporary directory by exploiting unsanitized filenames in email attachments. By sending crafted attachments containing '../' sequences, attackers can overwrite sensitive files, such as the user's .forward file, which could lead to potential command execution and further compromise of the server. It is critical for users of affected versions to apply the necessary mitigations and updates to safeguard against these threats.

References