Webmin EUVD-2026-32528

Webmin is a web-based Unix/Linux system administration panel. The mailboxes module provides an email client interface, and detach.cgi is the CGI script responsible for serving email attachments to the browser. Prior to version 2.640, the script passed SVG attachments directly to the browser with their native content type (image/svg+xml or inferred from a .svg/.svgz filename). Modern browsers treat SVG as an active XML document capable of executing embedded <script> tags when served from a web origin - in this case, the Webmin administration origin. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): attacker-controlled data (the SVG file) was rendered as an executable document in a privileged origin context. The commit diff at cf432879a confirms the fix: the script now detects SVG by content-type regex (^image\/svg(\+xml)?), by the type query parameter, and by filename extension (.svg/.svgz), and downgrades the served content type to text/plain, preventing script execution. The same commit also added filename sanitization to strip path traversal characters (\, /, null bytes, CRLF) in detach.cgi and detachall.cgi.