GHSA-x8qr-rx2g-f23g: Webmin: SSRF exploit in Upload and Download and File Manager modules

Published Nov 4, 2026

Updated

Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not restricted by resolved IP address. This allows requests to unauthenticated intranet services or cloud-provider instance metadata endpoints that are inaccessible from the user's own system. This issue is fixed in 2.652.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Webmin to a version that resolves this vulnerability.
Fixed in 2.652

Event History

Nov 4, 2026

CVE Published

via OSV·10:56 PM

Data Sourced

via OSV·10:56 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Webmin deployments before 2.652 are exposed if untrusted users can access the File Manager or Upload and Download modules. The affected functionality runs from the Webmin server, so it can reach network locations that may not be accessible from the user's own system.

What does an attacker need to exploit it?

An attacker needs access to either the File Manager or Upload and Download module and must be able to invoke its server-side URL download functionality. No user interaction is required after the attacker has that access.

What resources could an attacker reach?

The issue can be used to send requests to non-public network addresses, including unauthenticated intranet services and cloud-provider instance metadata endpoints. The impact depends on what services or metadata endpoints the Webmin server can reach.

How can I remediate the issue?

Update Webmin to version 2.652, which fixes the issue. If updating cannot happen immediately, restrict untrusted users' access to the File Manager and Upload and Download modules.

GHSA-x8qr-rx2g-f23g: Webmin: SSRF exploit in Upload and Download and File Manager modules

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What resources could an attacker reach?

How can I remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What resources could an attacker reach?

How can I remediate the issue?