File Management Vulnerability in Webmin by Webmin

CVE-2026-102337

What is CVE-2026-102337?

Webmin, a popular web-based system administration tool for Unix-like servers, contains a vulnerability that allows untrusted users with access to the File Manager or Upload and Download modules to exploit server-side URL download capabilities. Specifically, users can direct downloads to non-public network addresses, circumventing restrictions that should prevent access to internal services or cloud metadata endpoints. This exposure allows potential unauthorized access to sensitive data that should otherwise be protected. The vulnerability has been addressed in version 2.652.

References