---
id: CVE-2026-123622
title: Usermin through 2.570 XSS via mailbox detach.cgi type Parameter
summary: >-
  Usermin through 2.570 contains a cross-site scripting vulnerability in
  mailbox/detach.cgi that allows remote attackers to execute script by supplying
  an arbitrary type parameter that bypasses JavaScript filtering. Attackers can
  email an …
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: webmin
product: usermin
affected:
  - usermin <= 2.570
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:00:57.104Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123622'
references:
  - url: 'https://github.com/webmin/usermin/issues/142'
    label: 'GitHub Issue #142'
  - url: 'https://github.com/webmin/usermin'
  - url: >-
      https://github.com/webmin/usermin/commit/c5c43b9ad04a60809ac2eb271bf8f3d0fec2e46a
    label: Fix commit c5c43b9
  - url: 'https://github.com/webmin/usermin/blob/2.570/mailbox/detach.cgi#L80-L83'
    label: detach.cgi content type handling
  - url: 'https://hackmd.io/@leediay/H144QKY6zl'
    label: Researcher write-up
  - url: >-
      https://www.vulncheck.com/advisories/usermin-through-2.570-xss-via-mailbox-detach-cgi-type-parameter
    label: >-
      VulnCheck Advisory: Usermin through 2.570 XSS via mailbox detach.cgi type
      Parameter
tags:
  - cve.org
ingestedAt: '2026-11-06T15:54:04.078Z'
epss: 0.00259
epssPercentile: 0.17731
---

## Overview

Usermin through 2.570 contains a cross-site scripting vulnerability in mailbox/detach.cgi that allows remote attackers to execute script by supplying an arbitrary type parameter that bypasses JavaScript filtering. Attackers can email an HTML attachment containing script and lure recipients to a detach.cgi link with type=text/html to run script in the victim's authenticated Usermin session.

## Affected

- `usermin <= 2.570`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.