EUVD-2026-37908
GHSA-xpvh-gv3p-w5qx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no auth, no interaction; read-only .conf file disclosure yields partial confidentiality loss only, with no integrity or availability impact.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.
AnalysisAI
Unauthenticated remote file disclosure in Webmin (all versions prior to 2.641) exposes the contents of any .conf file residing within module directories. The root cause is a flawed regular expression (CWE-185) that was intended to restrict accessible file paths but can be bypassed with a crafted request, allowing unauthenticated network attackers to read configuration files that may contain credentials, API keys, or other sensitive deployment data. No public exploit or CISA KEV listing has been identified at time of analysis, though the zero-authentication, network-accessible attack surface makes this straightforward to probe at scale.
Technical ContextAI
Webmin is a web-based Unix/Linux system administration interface (cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*). Its module architecture stores per-module configuration in .conf files under module-specific directories. The vulnerability is classified as CWE-185 (Incorrect Regular Expression): Webmin uses a regex pattern to gate file-read operations and restrict them to permitted paths, but the pattern contains a logical flaw that permits bypass. Because the regex check is the sole access control on this file-serving code path, and no authentication is required before the check is evaluated, an attacker can craft a request that satisfies the bypassed regex while still resolving to an arbitrary .conf file within the module directory tree. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the code path is reachable over the network without credentials or user interaction.
RemediationAI
The primary remediation is upgrading to Webmin 2.641 or later, which contains the corrected regular expression. The vendor security page (https://webmin.com/security/#webmin-prior-to-2641) and the official GitHub release (https://github.com/webmin/webmin/releases/tag/2.641) confirm 2.641 as the fix version. Note that the 2.641 release notes do not explicitly name this CVE fix, but the vendor advisory unambiguously identifies 2.641 as the remediated version. If immediate upgrade is not possible, the most effective compensating control is restricting network access to the Webmin web interface (default port 10000) to trusted IP ranges via firewall rules or a reverse proxy with IP allowlisting, which eliminates the unauthenticated network attack vector. Additionally, auditing .conf files in Webmin module directories for embedded credentials and rotating any exposed secrets is advisable regardless of patch status, since prior exploitation cannot be ruled out on long-running instances.
An issue was discovered in Webmin <=1.920. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitabl
file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid
file/edit_html.cgi in Webmin 1.590 and earlier does not perform an authorization check before showing a file's unedited
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command. Rated critical severity (CVSS 9.8), thi
Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990. Rated high severity
In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root pr
SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/h
Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Dow
Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's ru
CSRF exists in Webmin 1.850. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authenticati
Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually creat
Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users fea
Same weakness CWE-185 – Incorrect Regular Expression
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today