Description
Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email attachments with ../ sequences in filenames, and when the recipient downloads all attachments, files like ~/.forward are overwritten, enabling command execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| webmin | usermin | ≤ 2.570 | — |
References
- GitHub Issue #142 issue-tracking
- https://github.com/webmin/usermin product
- Fix commit cb4614e patch
- detachall.cgi attachment write technical-description
- Researcher write-up technical-description
- VulnCheck Advisory: Usermin through 2.570 Path Traversal File Write via detachall.cgi third-party-advisory