Webmin CVE-2026-49103

Exploitation requires an authenticated Webmin account (PR:L) with access to the mailboxes/webmail component enabled, plus an email attachment whose filename the attacker can set - most directly achieved by the attacker mailing a crafted attachment to a mailbox they can then process. The triggering action is invoking detachall.cgi's attachment-saving path. No additional user interaction is needed (UI:N). Exploitation is limited to Webmin versions before 2.640, requires the mailboxes module to be in use, and depends on the attacker holding valid credentials - so it is not exploitable by an unauthenticated remote attacker, and the SSVC 'Automatable: no' rating reflects these per-target prerequisites.

Signals are mostly aligned toward a serious but not yet exploited issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows a network-reachable, low-complexity attack with no user interaction, but PR:L confirms an authenticated account is required, which materially lowers the exposure compared to a pre-auth bug. The 9.4 score is driven by uniformly High vulnerable- and subsequent-system impact (VC/VI/VA and SC/SI/SA all H), consistent with an arbitrary file write that can escalate to system compromise. CISA SSVC reinforces a measured priority: Exploitation 'none', Automatable 'no', but Technical Impact 'total'. No EPSS score was provided in the input, so exploitation probability cannot be quantified here, and there is no KEV listing or POC. Note a tagging conflict: the intelligence tag is 'Information Disclosure', yet the CWE-24 path traversal in a file-save routine and the VI:H/SI:H integrity ratings indicate the dominant impact is arbitrary file write, not just disclosure - the tag appears to understate the risk.

An authenticated low-privileged Webmin user sends or receives an email containing an attachment whose MIME filename embeds traversal sequences or an absolute path (for example, name fields like '..%2f..%2fpath/file'). When the user runs the 'detach all attachments' function, detachall.cgi writes the attachment outside the intended save directory, allowing overwrite of sensitive files and potentially leading to code execution. No public proof-of-concept has been identified, and the attack hinges on the low complexity (AC:L) and lack of required interaction (UI:N) noted in the CVSS vector.