Description

Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email attachments with ../ sequences in filenames, and when the recipient downloads all attachments, files like ~/.forward are overwritten, enabling command execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-06T15:17:19.730Z",
  "pubdate": "2026-11-06T15:17:19.730Z",
  "executiveSummary": "Usermin versions through 2.570 are susceptible to a critical path traversal vulnerability located within the mailbox/detachall.cgi script. This vulnerability permits a remote, unauthenticated attacker to execute arbitrary code on the underlying system. The flaw originates from the improper sanitization of attachment filenames during the batch download process, which allows an attacker to escape the restricted temporary directory and overwrite arbitrary files on the filesystem. By crafting an email with malicious filenames containing directory traversal sequences (e.g., ../), an attacker can target sensitive configuration files such as ~/.forward. Successful exploitation results in remote code execution under the context of the user running the Usermin process. Due to the lack of required authentication for the initial attack vector and the potential for full system compromise, this vulnerability presents a severe risk to confidentiality, integrity, and availability. Organizations are advised to restrict access to the affected interface and apply security updates as they become available to remediate the underlying input validation failures.",
  "technicalDetails": "The vulnerability resides in the mailbox/detachall.cgi component of Usermin, which is designed to process and bundle attachments for download by the authenticated user. The root cause of the vulnerability is an insecure implementation of filename handling, where user-supplied input derived from email attachment headers is not sufficiently sanitized against directory traversal sequences.\nWhen an attacker sends an email to a victim using Usermin, they can specify malicious attachment filenames. These filenames are not validated for path traversal characters, such as '../', which allow an attacker to navigate outside the intended temporary working directory. When the victim initiates a 'detach all' operation, the CGI script processes these malicious strings without adequate path normalization or boundary checks.\nThe attack flow proceeds as follows: 1. The attacker composes an email containing an attachment with a filename structured with traversal sequences, such as '../../../../home/user/.forward'. 2. The victim receives the email and interacts with the Usermin mailbox interface to download all attachments. 3. Upon triggering the detachment process, the backend script fails to neutralize the traversal sequences, leading the system to write the attachment content to the resolved target path rather than the designated temporary directory. 4. By overwriting critical files like .forward, the attacker injects malicious commands that will be executed by the system's mail transfer agent (MTA) or shell upon subsequent events.\nThis vulnerability is particularly dangerous because it facilitates remote code execution without requiring the attacker to have pre-existing privileges on the target system. The lack of input validation on filename headers effectively turns a standard file handling operation into an arbitrary file write primitive. Since Usermin often operates with user-level privileges, the ability to modify dot-files (like .forward, .procmailrc, or .bashrc) directly results in command execution once the shell or MTA parses these modified configurations. The attack surface is exposed via the web interface, requiring no interaction with the Usermin process prior to the malicious file being delivered to the user's mailbox. Because the malicious payload is delivered via standard SMTP protocols and triggered by the victim's interaction with the Usermin application, it bypasses many traditional perimeter security controls that do not inspect email attachments for filename-based path traversal logic."
}