Webmin CVE-2026-56021

No authentication is required - the vulnerable file-read code path is reachable before any credential check, as confirmed by PR:N and UI:N in the CVSS vector. The attacker must be able to reach the Webmin web interface over the network (typically TCP/10000). Exploitation is scoped to files ending in .conf within Webmin module directories; arbitrary filesystem reads outside this scope are not indicated by available data. Webmin running in default configuration on any supported OS platform is vulnerable. The primary limiting factor is network exposure: instances restricted to loopback or a private management network are not reachable by external attackers. No specific non-default configuration or feature toggle is required to trigger the vulnerability.

The CVSS 3.1 base score of 5.3 (Medium) reflects a limited-scope confidentiality impact (C:L) with no integrity or availability consequence, which is consistent with a read-only file disclosure primitive. The attack vector is maximally accessible - AV:N/AC:L/PR:N/UI:N - meaning any internet-exposed Webmin instance is vulnerable without any preconditions. The practical severity is therefore higher than the score implies: .conf files in Webmin module directories frequently contain database credentials, SMTP passwords, API tokens, and remote host access details, so successful exploitation can serve as a credential-harvesting step enabling lateral movement or privilege escalation. No EPSS score was provided in the input data; given the broad attack surface and unauthenticated network vector, real-world exploitation probability is non-trivial. No KEV listing and no POC code have been identified, which tempers urgency somewhat, but the simplicity of regex-bypass attacks and Webmin's widespread deployment in managed hosting environments make this a meaningful exposure. The CISA-CG reporter origin and published CSAF advisory suggest this was treated as a credible finding warranting formal tracking.

An unauthenticated attacker sends a crafted HTTP GET request to a publicly accessible Webmin instance, constructing a file path that satisfies the flawed regex while pointing to a sensitive .conf file - for example, a module configuration containing a database password. The server responds with the raw file contents. No public POC has been identified at time of analysis, but the attack requires no authentication and low technical complexity given the regex-bypass class of vulnerability.