Unauthenticated File Read in Webmin via Bypassed Regex

Publication date: 2026-06-18

Last updated on: 2026-06-24

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-18

Last Modified

2026-06-24

Generated

2026-07-09

AI Q&A

2026-06-18

EPSS Evaluated

2026-07-08

NVD

CVE-2026-56021

EUVD

EUVD-2026-37908

Affected Vendors & Products

Vendor	Product	Version / Range
webmin	webmin	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-185	The product specifies a regular expression in a way that causes data to be improperly matched or compared.
CWE-777	The product uses a regular expression to perform neutralization, but the regular expression is not anchored and may allow malicious or malformed data to slip through.

Attack-Flow Graph

Executive Summary

This vulnerability in Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories. This happens because of a bypassable regular expression pattern that fails to properly restrict access.

Impact Analysis

An attacker exploiting this vulnerability can access configuration files without authentication. This could lead to exposure of sensitive configuration data, potentially compromising system security or revealing information that could be used in further attacks.

Hi! I’m here to help you understand CVE-2026-56021. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70