CVE-2026-102337

UNKNOWN 0.0

Webmin: SSRF exploit in Upload and Download and File Manager modules

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not restricted by resolved IP address. This allows requests to unauthenticated intranet services or cloud-provider instance metadata endpoints that are inaccessible from the user's own system. This issue is fixed in 2.652.

CWE	CWE-918
Vendor	webmin
Product	webmin
Published	Nov 4, 2026

Stay Ahead of the Next One

Get instant alerts for webmin webmin

Be the first to know when new unknown vulnerabilities affecting webmin webmin are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

webmin / webmin

< 2.652

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/webmin/webmin/security/advisories/GHSA-x8qr-rx2g-f23g github.com: https://github.com/webmin/webmin/pull/2789 github.com: https://github.com/webmin/webmin/commit/5b6b43ac3d09ff582c1fa89d9589324f02320c42 github.com: https://github.com/webmin/webmin/commit/e805319233c5a6837e97b35a329c6bb2cad82657 github.com: https://github.com/webmin/webmin/commit/f62fd9e23adc9dc7c65ff75b31d10ae3e7eadc90 github.com: https://github.com/webmin/webmin/releases/tag/2.652