{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-102337","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-09-28T22:38:42.254Z","datePublished":"2026-11-04T22:56:51.120Z","dateUpdated":"2026-11-04T22:56:51.120Z"},"containers":{"cna":{"title":"Webmin: SSRF exploit in Upload and Download and File Manager modules","problemTypes":[{"descriptions":[{"cweId":"CWE-918","lang":"en","description":"CWE-918: Server-Side Request Forgery (SSRF)","type":"CWE"}]}],"metrics":[{"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","version":"4.0"}}],"references":[{"name":"https://github.com/webmin/webmin/security/advisories/GHSA-x8qr-rx2g-f23g","tags":["x_refsource_CONFIRM"],"url":"https://github.com/webmin/webmin/security/advisories/GHSA-x8qr-rx2g-f23g"},{"name":"https://github.com/webmin/webmin/pull/2789","tags":["x_refsource_MISC"],"url":"https://github.com/webmin/webmin/pull/2789"},{"name":"https://github.com/webmin/webmin/commit/5b6b43ac3d09ff582c1fa89d9589324f02320c42","tags":["x_refsource_MISC"],"url":"https://github.com/webmin/webmin/commit/5b6b43ac3d09ff582c1fa89d9589324f02320c42"},{"name":"https://github.com/webmin/webmin/commit/e805319233c5a6837e97b35a329c6bb2cad82657","tags":["x_refsource_MISC"],"url":"https://github.com/webmin/webmin/commit/e805319233c5a6837e97b35a329c6bb2cad82657"},{"name":"https://github.com/webmin/webmin/commit/f62fd9e23adc9dc7c65ff75b31d10ae3e7eadc90","tags":["x_refsource_MISC"],"url":"https://github.com/webmin/webmin/commit/f62fd9e23adc9dc7c65ff75b31d10ae3e7eadc90"},{"name":"https://github.com/webmin/webmin/releases/tag/2.652","tags":["x_refsource_MISC"],"url":"https://github.com/webmin/webmin/releases/tag/2.652"}],"affected":[{"vendor":"webmin","product":"webmin","versions":[{"version":"< 2.652","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-11-04T22:56:51.120Z"},"descriptions":[{"lang":"en","value":"Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not restricted by resolved IP address. This allows requests to unauthenticated intranet services or cloud-provider instance metadata endpoints that are inaccessible from the user's own system. This issue is fixed in 2.652."}],"source":{"advisory":"GHSA-x8qr-rx2g-f23g","discovery":"UNKNOWN"}}}}