Threats affecting pkg:github/usermin

Usermin versions up to 2.570 contain a cross-site scripting (XSS) vulnerability in the mailbox/detach.cgi component. This flaw allows remote attackers to execute arbitrary scripts by manipulating the 'type' parameter, bypassing JavaScript filtering. Exploitation involves sending an HTML attachment with script and tricking users into clicking a crafted detach.cgi link, enabling script execution within the victim's authenticated Usermin session.

Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email attachments with ../ sequences in filenames, and when the recipient downloads all attachments, files like ~/.forward are overwritten, enabling command execution.

Usermin versions up to 2.570 contain an OS command injection vulnerability in the Read Mail module. Authenticated users can exploit this by creating IMAP folders with shell metacharacters via an external IMAP client. When these folders are deleted in Usermin, the unsanitized folder names allow execution of arbitrary system commands, bypassing webmail-only restrictions.