This vulnerability allows an attacker to exploit the path traversal flaw in Usermin’s mailbox/detachall.cgi script to write files outside the intended temporary directory. By sending email attachments whose filenames contain directory traversal sequences, the victim’s download of all attachments triggers the script to create or overwrite arbitrary files such as ~/.forward. Overwriting this file enables the attacker to execute commands with the mail user’s privileges, potentially compromising the entire user account or system.

All Usermin deployments using version 2.570 or earlier are affected, regardless of platform. The flaw resides in the Usermin mailbox module’s detachall.cgi handler and exploits unsanitized attachment filenames.

The CVSS score of 8.6 reflects the high severity of this flaw. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path requires a remote, unauthenticated attacker to send a crafted email with malicious attachment names to a victim. When that victim downloads all attachments, the vulnerable script writes the attacker‑supplied files outside the temporary directory, overwriting sensitive files such as ~/.forward and permitting remote code execution. Existing mitigations are insufficient because the flaw is triggered by standard attachment download behaviour.