CVE-2026-49103CWE-24

Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component

Critical · published May 27, 2026

CVSS v4.0
9.4
EPSS
0%
Percentile
38.4
In the wild
Unconfirmed
What it is

Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00454 · 38.4th percentile
Weakness
CWE-24 · Path Traversal: '../filedir'
Published
2026-05-27T14:37Z
EPSS history
Timeline
  • 27 MAY 14:37Z
    Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component
    cvelistv5