CVE-2026-49103: Webmin before 2

Synopsis

This is a path traversal or unsafe filename construction vulnerability in Webmin's mailboxes component, specifically in mailboxes/detachall.cgi, affecting all versions before 2.640. An authenticated attacker can reach it over the network with a low-privilege account and no victim interaction required. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of both the local system and any systems it connects to. A patched-image rebuild at version 2.640 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Webmin service over the network; the component is network-exposed by design.

• AuthenticationRequired

  A low-privilege authenticated account is sufficient; no administrative access is needed to trigger the unsafe filename construction.

• Victim interactionNot required

  No user interaction is required; the attacker can trigger the vulnerability directly without involving another user.

• Attack complexityDetail

  Exploitation is reliable and condition-free, with no race conditions or special environmental factors required.

Blast Radius

• A successful attacker reads sensitive files on the Webmin host, including credentials, configuration files, and stored mail attachments.
• The attacker writes or overwrites arbitrary files on the host, enabling persistent backdoor installation or configuration tampering.
• The attacker can crash or destabilize the Webmin service, disrupting administrative access to the host.
• Because both system and downstream scope scores are High across confidentiality, integrity, and availability, the attacker can pivot to connected systems and services that Webmin manages.