CVE-2026-102337 Details
Description
Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not restricted by resolved IP address. This allows requests to unauthenticated intranet services or cloud-provider instance metadata endpoints that are inaccessible from the user's own system. This issue is fixed in 2.652.
A vulnerability in Webmin prior to version 2.652 allows untrusted users with access to the File Manager or Upload and Download modules to exploit the server-side URL download feature. The vulnerability arises because download destinations are not restricted by resolved IP address, enabling access to non-public network addresses. This could lead to requests being sent to unauthenticated intranet services or cloud provider instance metadata endpoints that are otherwise inaccessible from the user's system.
Users can upgrade to Webmin version 2.652 or later, which includes a global per-user ACL control to block URL downloads from non-public IP addresses. Instructions for downloading the latest version of Webmin are available on the Webmin GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/webmin/webmin/commit/5b6b43ac3d09ff582c1fa89d9589324f02320c42 | [email protected] | Source CodeVendor |
| https://github.com/webmin/webmin/commit/e805319233c5a6837e97b35a329c6bb2cad82657 | [email protected] | Source CodeVendor |
| https://github.com/webmin/webmin/commit/f62fd9e23adc9dc7c65ff75b31d10ae3e7eadc90 | [email protected] | Source CodeVendor |
| https://github.com/webmin/webmin/pull/2789 | [email protected] | Issue TrackingVendor |
| https://github.com/webmin/webmin/releases/tag/2.652 | [email protected] | Release NotesVendor |
| https://github.com/webmin/webmin/security/advisories/GHSA-x8qr-rx2g-f23g | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Webmin | < 2.652 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | [email protected] |