Read the docs
TI-2026-85264 Aliases CVE-2026-102337

Server-side request forgery in Webmin File Manager and Upload and Download

Priority LOW 23CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Webmin, a web-based system administration tool for Unix-like servers, is affected before 2.652. Users with access to the File Manager or Upload and Download modules can make the server fetch URLs at non-public network addresses because download destinations are not checked by resolved IP address, a server-side request forgery flaw (CWE-918). An attacker with low privileges can reach unauthenticated intranet services or cloud instance metadata endpoints that are not reachable from their own system.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not restricted by resolved IP address. This allows requests to unauthenticated intranet services or cloud-provider instance metadata endpoints that are inaccessible from the user's own system. This issue is fixed in 2.652.

Why it matters now

EPSS 0.00515 44th percentileScored 2026-11-07
Fix Fixed webmin (webmin): 2.652

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Webminwebminbefore 2.6522.652Patch availableCNA
  • webmin VendorWebmin Affected before 2.652 Fixed in 2.652 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*——Webmin
  • cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:* Versions — — ·Webmin

Remediation

Upgrade Webmin to version 2.652, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA webmin (webmin) Fixed in 2.652

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-102337

References

Other 6

  • TI-2019-11278 An issue was discovered in Webmin <=1.920. KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-16770 software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command. CVSS 3.1CRITICAL 9.8
  • TI-2022-00731 Improper Access Control to Remote Code Execution in webmin/webmin CVSS 3.1HIGH 8.8
  • TI-2019-09619 In Webmin through 1.910, any user authorized to the "Package Updates" module can execute… CVSS 3.0HIGH 8.8
  • TI-2015-01866 Code injection in Usermin CVSS 3.1CRITICAL 9.9
  • TI-2022-15852 Usermin through 1.850 allows a remote authenticated user to execute OS commands via… CVSS 3.1HIGH 8.8
See all 121 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences