CVE-2026-56021mediumCWE-185CWE-777

CVE-2026-56021: medium-severity vulnerability in Webmin

Webmin information disclosure via regex pattern

Published · Updated

Follow this CVE+ Monitor Webmin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.5%
Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Webmin · Webmin
Related CVEs — Webmin

In the same product, most dangerous first.

CVE-2024-12828CRITICALWebmin CGI Command Injection Remote Code Execution VulnerabilityEPSS 33.3%CVE-2017-2106—CVE-2017-2106EPSS 1.7%CVE-2024-36451HIGHCVE-2024-36451EPSS 0.6%CVE-2026-56022MEDIUMWebmin MFA bypassEPSS 0.6%CVE-2026-56020CRITICALWebmin HTTP header authentication bypassEPSS 0.5%CVE-2024-36453MEDIUMCVE-2024-36453EPSS 0.4%