CVE-2026-102337: Webmin: SSRF exploit in Upload and Download and File Manager modules
Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not restricted by resolved IP address. This allows requests to unauthenticated intranet services or cloud-provider instance metadata endpoints that are inaccessible from the user's own system. This issue is fixed in 2.652.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Webminto a version that resolves this vulnerability.Fixed in 2.652
Event History
Frequently Asked Questions
Who is exposed to this issue?
Webmin installations earlier than 2.652 are exposed when untrusted users can access either the File Manager or Upload and Download modules. The vulnerable behavior is Webmin's server-side URL download capability.
What does an attacker need to exploit it?
An attacker needs a Webmin account with access to the File Manager or Upload and Download modules. They can then supply a URL targeting a non-public network address; no user interaction is required.
What could an attacker reach through the vulnerable download feature?
The issue can cause the Webmin server to send requests to unauthenticated intranet services or cloud-provider instance metadata endpoints that the attacker cannot access directly. The provided data identifies confidentiality impact and a subsequent-system confidentiality impact, but does not state that responses are returned to the attacker.
What should be done if upgrading cannot happen immediately?
Restrict untrusted users' access to the File Manager and Upload and Download modules, since access to either module is a stated prerequisite for exploitation. Upgrade to Webmin 2.652 when possible.