Description

Usermin through 2.570 contains a cross-site scripting vulnerability in mailbox/detach.cgi that allows remote attackers to execute script by supplying an arbitrary type parameter that bypasses JavaScript filtering. Attackers can email an HTML attachment containing script and lure recipients to a detach.cgi link with type=text/html to run script in the victim's authenticated Usermin session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-11-06T15:17:19.900Z",
  "pubdate": "2026-11-06T15:17:19.900Z",
  "executiveSummary": "A reflected cross-site scripting (XSS) vulnerability exists within the mailbox/detach.cgi component of Usermin through version 2.570.\nThe vulnerability originates from inadequate input validation of the 'type' parameter, which allows for the bypass of existing JavaScript filters.\nAn unauthenticated remote attacker can leverage this flaw by sending a specially crafted email containing an HTML attachment to a targeted user.\nBy tricking an authenticated victim into accessing a maliciously crafted URL targeting detach.cgi with the parameter type=text/html, the attacker can execute arbitrary JavaScript within the context of the victim's active web session.\nThe successful exploitation of this vulnerability compromises the integrity of the user's session, potentially leading to unauthorized actions, session hijacking, or sensitive information disclosure.\nThe risk is significant as it requires minimal user interaction—merely clicking a link—to trigger the execution of unauthorized client-side scripts, effectively bypassing same-origin policy protections intended to isolate the Usermin interface.",
  "technicalDetails": "The root cause of the vulnerability is improper neutralization of user-supplied data in the mailbox/detach.cgi script of Usermin versions 2.570 and earlier. Specifically, the application fails to properly sanitize or validate the 'type' parameter before processing it in a manner that influences the rendering of HTML content.\nWhen a user accesses the detach.cgi endpoint, the application is designed to process attachments, including those of various MIME types. The current implementation contains a flaw in the filtering logic that is intended to prevent the execution of malicious scripts when rendering these attachments. By providing an arbitrary 'type' parameter—specifically type=text/html—the attacker is able to force the application to handle an attachment in a way that bypasses the restrictive filters, effectively treating the injected content as active HTML.\nThe attack flow begins with the attacker crafting an email containing an HTML attachment embedded with a malicious JavaScript payload. This email is sent to the target, who must be an authenticated user of Usermin. The attacker then lures the victim to click a specially crafted link pointing to the mailbox/detach.cgi component. This URL includes the manipulated 'type=text/html' parameter along with references to the malicious attachment.\nUpon clicking the link, the victim's browser initiates a request to the Usermin server. The server, processing the request through detach.cgi, identifies the 'type' parameter and, due to the filter bypass, improperly renders the contents of the attachment. Because this occurs within the victim's authenticated browser session, the malicious JavaScript payload is executed under the security context of the Usermin web application.\nThis execution happens because the browser trusts the content delivered by the Usermin origin. Consequently, the script has full access to the Document Object Model (DOM), allowing the attacker to perform actions such as extracting session cookies (if not protected by HttpOnly flags), performing unauthorized administrative or user-level operations on behalf of the victim, or redirecting the user to malicious sites.\nThis vulnerability is classified as reflected XSS, as the malicious payload is reflected off the web server to the victim's browser without being persistently stored on the server, yet it relies on the victim interacting with the malicious request while logged into the application."
}