---
id: CVE-2026-102337
title: 'Webmin: SSRF exploit in Upload and Download and File Manager modules'
summary: >-
  Webmin is a web-based system administration tool for Unix-like servers. Prior
  to 2.652, untrusted users with access to the File Manager or Upload and
  Download modules can direct Webmin's server-side URL download functionality to
  non-publ…
severity: medium
cvss: 4.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: webmin
product: webmin
affected:
  - webmin < 2.652
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T22:56:51.120Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-102337'
references:
  - url: 'https://github.com/webmin/webmin/security/advisories/GHSA-x8qr-rx2g-f23g'
    label: 'https://github.com/webmin/webmin/security/advisories/GHSA-x8qr-rx2g-f23g'
  - url: 'https://github.com/webmin/webmin/pull/2789'
    label: 'https://github.com/webmin/webmin/pull/2789'
  - url: >-
      https://github.com/webmin/webmin/commit/5b6b43ac3d09ff582c1fa89d9589324f02320c42
    label: >-
      https://github.com/webmin/webmin/commit/5b6b43ac3d09ff582c1fa89d9589324f02320c42
  - url: >-
      https://github.com/webmin/webmin/commit/e805319233c5a6837e97b35a329c6bb2cad82657
    label: >-
      https://github.com/webmin/webmin/commit/e805319233c5a6837e97b35a329c6bb2cad82657
  - url: >-
      https://github.com/webmin/webmin/commit/f62fd9e23adc9dc7c65ff75b31d10ae3e7eadc90
    label: >-
      https://github.com/webmin/webmin/commit/f62fd9e23adc9dc7c65ff75b31d10ae3e7eadc90
  - url: 'https://github.com/webmin/webmin/releases/tag/2.652'
    label: 'https://github.com/webmin/webmin/releases/tag/2.652'
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.668Z'
epss: 0.00515
epssPercentile: 0.44091
---

## Overview

Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not restricted by resolved IP address. This allows requests to unauthenticated intranet services or cloud-provider instance metadata endpoints that are inaccessible from the user's own system. This issue is fixed in 2.652.

## Affected

- `webmin < 2.652`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.