CVE-2026-102337 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Webmin, a web tool for administering Unix servers, lets users with File Manager or Upload and Download access make its server fetch URLs, but does not block private network addresses. An attacker with that access can read unauthenticated internal services and cloud instance metadata endpoints.
first public Jul 30, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Servers running Webmin before 2.652 where some users can reach the File Manager or Upload and Download modules. The exposure comes from those module permissions, so installations where only fully trusted administrators can use these modules carry less risk. Hosts in cloud environments with instance metadata endpoints are the most sensitive.
Not affected if managed-hosting, no-file-manager-access, webmin-2.652-or-later
Who cares cloud, linux-servers, self-hosted, webmin
webmin --version or the version shown in the Webmin dashboard.2.652 or later.Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not restricted by resolved IP address. This allows requests to unauthenticated intranet services or cloud-provider instance metadata endpoints that are inaccessible from the user's own system. This issue is fixed in 2.652.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.