Usermin versions up to 2.570 contain a cross‑site scripting vulnerability in mailbox/detach.cgi. By supplying an arbitrary value for the type parameter the script bypasses JavaScript filtering, allowing an attacker to inject and execute script in the victim’s authenticated Usermin session. The flaw can be triggered when an email contains an HTML attachment; the recipient, lured to access a detach.cgi link with type=text/html, will have the malicious script run in the context of Usermin.

The vulnerability affects the Webmin Usermin component, specifically all releases up to and including 2.570. The product is distributed as the webmin:usermin appliance and is used by administrators to manage user accounts and mailboxes.

The CVSS base score of 5.1 indicates moderate risk. EPSS is not available, and the CVE is not listed in the CISA KEV catalog. Attackers must lure a valid Usermin user to click a crafted detach.cgi link or deliver an HTML attachment; the attack requires remote access to the Webmin server and an existing authenticated session. While the flaw does not allow arbitrary code execution on the host, it can compromise user credentials or session data within the vulnerable system.