---
id: "CVE-2026-102337"
kind: "vulnerability"
aliases: ["CVE-2026-102337"]
title: "Webmin: file manager URL download can reach internal network addresses"
severity: "medium"
cvss: 4.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["cloud", "infrastructure", "linux-servers", "self-hosted", "webmin"]
not_affected_if: ["managed-hosting", "no-file-manager-access", "webmin-2.652-or-later"]
published_at: "2026-11-04T23:17:17+00:00"
first_seen_at: "2026-11-05T00:30:59+00:00"
updated_at: "2026-11-05T00:32:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102337", "first_seen_at": "2026-11-05T00:30:59+00:00"}]
exploit_sources: []
---

# Webmin: file manager URL download can reach internal network addresses

Webmin, a web tool for administering Unix servers, lets users with File Manager or Upload and Download access make its server fetch URLs, but does not block private network addresses. An attacker with that access can read unauthenticated internal services and cloud instance metadata endpoints.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Webmin version against the fixed release, for example with `webmin --version` or the version shown in the Webmin dashboard.
- Check whether the File Manager or Upload and Download modules are enabled and which users can access them.

## Fix

- Webmin: upgrade to `2.652` or later.

## Timeline

- 2026-11-05T00:30:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102337

## Documents

- [advisory] Vendor advisory: github.com https://github.com/webmin/webmin/security/advisories/GHSA-x8qr-rx2g-f23g
- [fix] Patch: github.com https://github.com/webmin/webmin/commit/5b6b43ac3d09ff582c1fa89d9589324f02320c42
- [fix] Patch: github.com https://github.com/webmin/webmin/commit/e805319233c5a6837e97b35a329c6bb2cad82657
- [fix] Patch: github.com https://github.com/webmin/webmin/commit/f62fd9e23adc9dc7c65ff75b31d10ae3e7eadc90
- [fix] Release notes: github.com https://github.com/webmin/webmin/releases/tag/2.652

## From the sources

Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not restricted by resolved IP address. This allows requests to unauthenticated intranet services or cloud-provider instance metadata endpoints that are inaccessible from the user's own system. This issue is fixed in 2.652.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_