CVE-2026-102337mediumCWE-918

CVE-2026-102337: medium-severity vulnerability in webmin

Webmin: SSRF exploit in Upload and Download and File Manager modules

Published

Follow this CVE+ Monitor Webmin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.9epss 0.5%
Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not restricted by resolved IP address. This allows requests to unauthenticated intranet services or cloud-provider instance metadata endpoints that are inaccessible from the user's own system. This issue is fixed in 2.652.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
webmin · webmin
Related CVEs — webmin

In the same product, most dangerous first.

CVE-2026-42210MEDIUMWebmin 2FA requirement bypassEPSS 0.5%CVE-2026-49243CRITICALWebmin: Reflected XSS in the Configuration moduleEPSS 0.3%CVE-2026-124552MEDIUMWebmin through 2.670 Stored XSS via Shorewall and Shorewall6 list.cgiEPSS —