Usermin vulnerabilities

2 known vulnerabilities in Usermin from Webmin. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  usermin: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-123621Nov 6, 2026Webmin

  Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email attachments with ../ se

• 7.5 High severity

  usermin: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-123620Nov 6, 2026WebminEPSS 1.38%

  Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an externa