{"id":"CVE-2026-102337","kind":"vulnerability","aliases":["CVE-2026-102337"],"related":[],"title":"Webmin: file manager URL download can reach internal network addresses","description":"Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not restricted by resolved IP address. This allows requests to unauthenticated intranet services or cloud-provider instance metadata endpoints that are inaccessible from the user's own system. This issue is fixed in 2.652.","summary":"Webmin, a web tool for administering Unix servers, lets users with File Manager or Upload and Download access make its server fetch URLs, but does not block private network addresses. An attacker with that access can read unauthenticated internal services and cloud instance metadata endpoints.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud","infrastructure","linux-servers","self-hosted","webmin"],"not_affected_if":["managed-hosting","no-file-manager-access","webmin-2.652-or-later"],"how_to_check":"- Check the installed Webmin version against the fixed release, for example with `webmin --version` or the version shown in the Webmin dashboard.\n- Check whether the File Manager or Upload and Download modules are enabled and which users can access them.","fix":"- Webmin: upgrade to `2.652` or later.","status":"open","published_at":"2026-11-04T23:17:17+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","triaged_at":"2026-11-05T00:32:04+00:00","updated_at":"2026-11-05T00:32:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-05T00:32:04Z","model":"claude-haiku-5-5","output":{"fix":"- Webmin: upgrade to `2.652` or later.","reach":"network","title":"Webmin: file manager URL download can reach internal network addresses","impact":"medium","summary":"Webmin, a web tool for administering Unix servers, lets users with File Manager or Upload and Download access make its server fetch URLs, but does not block private network addresses. An attacker with that access can read unauthenticated internal services and cloud instance metadata endpoints.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["webmin","self-hosted","linux-servers","cloud"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"internal services and cloud metadata credentials reachable via server requests","analyst_note":"","how_to_check":"- Check the installed Webmin version against the fixed release, for example with `webmin --version` or the version shown in the Webmin dashboard.\n- Check whether the File Manager or Upload and Download modules are enabled and which users can access them.\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["webmin-2.652-or-later","no-file-manager-access","managed-hosting"],"who_is_affected":"Servers running Webmin before 2.652 where some users can reach the File Manager or Upload and Download modules. The exposure comes from those module permissions, so installations where only fully trusted administrators can use these modules carry less risk. Hosts in cloud environments with instance metadata endpoints are the most sensitive.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000713,"input_tokens":4334,"output_tokens":560,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-102337':13A,16A '-2026':12A,15A '2.652':87C,155C 'access':43B,60B,91C 'address':10A,55B,116C,126C 'administ':31B 'administr':78C 'allow':128C 'attack':57B 'base':76C 'block':52B 'cloud':17B,67B,136C 'cloud-provid':135C 'cve':11A,14A 'destin':119C 'direct':102C 'download':5A,42B,99C,109C,118C 'endpoint':70B,140C 'fetch':47B 'file':2A,37B,94C 'fix':153C 'function':110C 'host':24B 'inaccess':143C 'infrastructur':18B 'instanc':68B,138C 'intern':8A,64B 'intranet':132C 'ip':125C 'issu':151C 'let':34B 'like':83C 'linux':20B 'linux-serv':19B 'make':44B 'manag':3A,38B,95C 'metadata':69B,139C 'modul':100C 'network':9A,54B,115C 'non':113C 'non-publ':112C 'prior':85C 'privat':53B 'provid':137C 'public':114C 'reach':7A 'read':62B 'request':129C 'resolv':124C 'restrict':122C 'self':23B 'self-host':22B 'server':21B,33B,46B,84C,106C 'server-sid':105C 'servic':65B,133C 'side':107C 'system':77C,149C 'tool':29B,79C 'unauthent':63B,131C 'unix':32B,82C 'unix-lik':81C 'untrust':88C 'upload':40B,97C 'url':4A,48B,108C 'user':35B,89C,146C 'web':28B,75C 'web-bas':74C 'webmin':1A,25B,26B,71C,103C","nicknames":[],"mitigations":[],"who_affected":"Servers running Webmin before 2.652 where some users can reach the File Manager or Upload and Download modules. The exposure comes from those module permissions, so installations where only fully trusted administrators can use these modules carry less risk. Hosts in cloud environments with instance metadata endpoints are the most sensitive.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloud","infrastructure","linuxservers","medium","selfhosted","webmin"],"campaign_type":null,"first_public_at":"2026-07-30T18:23:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102337","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102337","severity":null,"published_at":"2026-11-04T23:17:17+00:00","modified_at":"2026-11-04T23:17:18+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","fetched_at":"2026-11-05T00:30:59+00:00","note":null}],"documents":[{"id":71448,"url":"https://github.com/webmin/webmin/commit/5b6b43ac3d09ff582c1fa89d9589324f02320c42","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71449,"url":"https://github.com/webmin/webmin/commit/e805319233c5a6837e97b35a329c6bb2cad82657","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71450,"url":"https://github.com/webmin/webmin/commit/f62fd9e23adc9dc7c65ff75b31d10ae3e7eadc90","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71451,"url":"https://github.com/webmin/webmin/releases/tag/2.652","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":71452,"url":"https://github.com/webmin/webmin/security/advisories/GHSA-x8qr-rx2g-f23g","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-30T18:23:24+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}