File Manipulation Vulnerability in Webmin Mailboxes Component
CVE-2026-49103

9.4CRITICAL

Key Information:

Vendor

Webmin

Status
Webmin
Vendor
CVE Published:
27 May 2026

What is CVE-2026-49103?

The Webmin mailboxes component prior to version 2.640 contains a vulnerability where the application does not properly construct filenames when saving attachments. This oversight can potentially lead to unauthorized file access or data loss. Specifically, the issue resides in the mailboxes/detachall.cgi script, allowing for risky file interactions that may compromise system integrity.

Affected Version(s)

Webmin 0 < 2.640

References

https://github.com/webmin/webmin/commit/cf432879a14568c4b...
https://github.com/webmin/webmin/compare/2.630...2.640

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.