CVE-2026-102337 in Webmin
Summary
by MITRE • 11/05/2026
Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not restricted by resolved IP address. This allows requests to unauthenticated intranet services or cloud-provider instance metadata endpoints that are inaccessible from the user's own system. This issue is fixed in 2.652.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/05/2026
Webmin serves as a widely deployed web-based interface for managing Unix-like systems, offering administrators convenient access to complex configuration tasks through a graphical environment. However, versions prior to 2.652 contain a critical server-side request forgery vulnerability within its File Manager and Upload and Download modules. The core technical flaw lies in the implementation of the URL download functionality, which allows users to specify arbitrary remote URLs for files to be fetched by the Webmin process itself rather than downloading them directly from their own client browsers. Crucially, this feature fails to validate or restrict the destination IP addresses based on whether they belong to public internet ranges or private internal networks. This lack of input validation regarding network scope enables an untrusted user with access to these specific modules to manipulate the server into initiating connections to resources that are otherwise inaccessible from the external-facing interface.
The operational impact of this vulnerability is significant, particularly in environments where Webmin is exposed to the internet but manages servers within a protected internal network or cloud infrastructure. An attacker can exploit this flaw to perform Server-Side Request Forgery attacks against local services running on loopback addresses such as 127.0.0.1, which are typically shielded from external access by firewalls and network segmentation policies. Furthermore, the vulnerability allows attackers to target internal intranet applications that may lack their own authentication mechanisms or rely solely on IP-based trust relationships. In cloud computing environments, this flaw can be leveraged to access instance metadata endpoints, such as those found in AWS EC2 or Google Cloud Platform, which often contain sensitive credentials and configuration data necessary for further compromise of the underlying infrastructure.
This vulnerability aligns with CWE-918, Server-Side Request Forgery (SSRF), specifically involving the lack of restrictions on server-side URL downloads to non-public network addresses. From a threat intelligence perspective, this behavior corresponds to techniques observed in ATT&CK framework under T1560, Archive Collected Data, and potentially T1071, Application Layer Protocol, as attackers may use standard web protocols to exfiltrate data or probe internal networks. The exploitation of this flaw does not require authentication for the target services if those services rely on network proximity rather than explicit user credentials, making it a potent tool for lateral movement and reconnaissance within compromised systems.
To mitigate this risk, organizations must immediately upgrade Webmin to version 2.652 or later, where the developers have implemented proper validation of destination IP addresses to prevent access to private ranges. For environments that cannot be patched instantly due to operational constraints, network-level controls should be enforced to restrict outbound connections from the Webmin server process to only necessary public endpoints. Additionally, implementing strict firewall rules that block outgoing traffic from the application layer to internal subnets and cloud metadata service IPs can provide a compensating control. Regular auditing of user permissions within Webmin is also recommended to ensure that access to file management modules is restricted to trusted administrators who require such capabilities for their operational duties.