CVE-2026-49103: 
Webmin vulnerability analysis and mitigation

CVE-2026-49103 is a path traversal vulnerability in Webmin's mailboxes component that allows authenticated attackers to write files outside of intended directories by exploiting unsafe filename construction during email attachment save operations. The flaw exists in mailboxes/detachall.cgi in all Webmin versions prior to 2.640. It was published on May 27, 2026, with a patch released in version 2.640. The vulnerability carries a CVSS v4.0 base score of 9.4 (Critical) (GitHub Advisory, Feedly).

The root cause is classified as CWE-24 (Path Traversal: ../filedir), where mailboxes/detachall.cgi used attacker-influenced attachment filenames directly to construct filesystem paths without sanitizing path traversal sequences such as ../ (GitHub Advisory). The fix in commit cf43287 added sanitization to strip \r, \n, null bytes, backslashes, and leading path components (s/^.*\///g) from filenames before use, and also addressed a related issue in mailboxes/detach.cgi where SVG attachments could execute scripts when served from the Webmin origin (Webmin Commit). Exploitation requires low-level authenticated access (e.g., a Webmin user with mailbox access), and no user interaction beyond the attacker's own actions is needed.

Successful exploitation allows an authenticated attacker to write arbitrary files to locations outside the intended temporary directory on the Webmin server, potentially enabling remote code execution by placing web shells or overwriting configuration files. The CVSS v4.0 scoring reflects high impact to confidentiality, integrity, and availability of both the vulnerable system and subsequent systems, indicating potential for full host compromise and lateral movement within the environment (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of this report. The CVE status is listed as "Deferred" and the EPSS score is approximately 0.046–0.051%, placing it in the 16th percentile for exploitation likelihood within 30 days (GitHub Advisory, Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing Webmin instances running versions prior to 2.640 using tools like Shodan or Censys, searching for the Webmin web interface (typically on port 10000).
2. Authentication: Obtain valid Webmin credentials with access to the mailboxes module (low-privilege account sufficient).
3. Craft malicious email: Send an email to the Webmin user's mailbox with an attachment whose filename contains path traversal sequences (e.g., ../../etc/cron.d/backdoor or ../../var/webmin/shell.cgi).
4. Trigger vulnerable endpoint: Use the Webmin mailboxes interface to save all attachments, which invokes mailboxes/detachall.cgi. The unsanitized filename is used directly to construct the output file path.
5. Achieve arbitrary file write: The attachment content is written to the attacker-controlled path outside the intended temp directory, potentially placing a web shell or overwriting a system file to achieve code execution (Webmin Commit, GitHub Advisory).

• File System: Unexpected files appearing outside the Webmin temporary attachment directory (e.g., in /etc/, /var/webmin/, or web-accessible directories); new or modified CGI scripts in the Webmin installation path; unexpected cron job files created by the Webmin process user.
• Logs: Webmin access logs showing requests to /mailboxes/detachall.cgi with unusual or encoded attachment filenames containing ../, ..\, or null bytes; file write operations to unexpected paths in system audit logs (auditd).
• Process: Unexpected child processes spawned by the Webmin Perl process (e.g., /bin/sh, curl, wget) following mailbox attachment save operations.

Upgrade Webmin to version 2.640 or later, which includes the fix for unsafe filename construction in both mailboxes/detachall.cgi and mailboxes/detach.cgi (Webmin Commit, GitHub Advisory). As a temporary workaround if upgrading is not immediately possible, restrict access to the Webmin mailboxes module to trusted users only, and limit network exposure of the Webmin interface using firewall rules. No vendor-provided configuration-only workaround has been published.