CVE-2026-49102

Executive Summary

CVE-2026-49102 is a reflected/stored cross-site scripting (XSS) vulnerability in Webmin versions prior to 2.640, specifically within the mailboxes/detach.cgi endpoint. An authenticated attacker—or an unauthenticated attacker tricking an authenticated user—can deliver a malicious SVG document as an email attachment; when the victim views that attachment in the Webmin mailboxes component, the image/svg+xml MIME type is served inline, allowing arbitrary JavaScript execution in the victim's browser session. This yields a Medium-severity (CVSS 6.1) attack capable of session hijacking, credential theft, and privileged actions within the Webmin administrative console. The vulnerability affects any self-hosted Webmin deployment exposing the mailboxes module, which is commonly enabled on internet-facing management interfaces.

Technical Analysis

The root cause of CVE-2026-49102 is the failure to enforce a safe Content-Type when serving email attachments through the mailboxes/detach.cgi handler. When a user accesses an email attachment via Webmin's mail module, the application relies on the MIME type declared in the original email message rather than sanitizing or overriding it. An attacker who controls the attachment's MIME type can set it to image/svg+xml, which modern browsers interpret as an executable document—not a static image. Any SVG can embed <script> blocks or event handler attributes (onload, onclick) that execute within the origin of the Webmin interface.

The vulnerable code path is as follows:

1. The mailboxes module parses a MIME-encoded email message.
2. When the user clicks "detach" (or views) an attachment, detach.cgi streams the raw attachment bytes back to the browser.
3. The Content-Type header is set to the MIME type extracted from the email, without sanitization. If the attacker sets Content-Type: image/svg+xml in the email's MIME part, the browser receives an SVG document with scriptable content. There is no Content-Disposition: attachment enforcement and no X-Content-Type-Options: nosniff header, so the browser renders the SVG inline.
4. The SVG executes in the context of the Webmin origin (https://<host>:10000), giving the attacker full access to the DOM, cookies (if not HttpOnly), CSRF tokens, and the ability to issue authenticated requests to any Webmin CGI endpoint.

The attack surface is the Webmin mail module, which may be exposed to the internet on TCP port 10000 (default) or via a reverse proxy on ports 80/443. Even if the mail module is not used by the administrator, the mere presence of the endpoint is exploitable if the Webmin user can be tricked into viewing a crafted email. The CVSS vector AC: L reflects that no special conditions are required beyond user interaction, and SC: C indicates the attack crosses a trust boundary (the attachment origin is different from the Webmin origin, but the script executes in the Webmin origin).

The fact that image/svg+xml is allowed at all—instead of being downgraded to text/plain—is the direct coding mistake. A properly hardened implementation would either force Content-Disposition: attachment for all non-whitelisted MIME types, or translate executable types (text/html, image/svg+xml, application/xhtml+xml) to text/plain when streaming through the detach handler.

Exploitation Scenarios

Scenario: Phishing an authenticated Webmin administrator

1. Reconnaissance: The attacker identifies a target Webmin instance via Shodan (http.title:"Webmin", port 10000) or by scanning for the distinctive login page. They confirm the version is < 2.640 by querying /session_login.cgi and examining the HTML source for version markers, or by checking the /help/ page which often discloses the build number.

2. Weaponization: The attacker crafts a malicious SVG file with embedded JavaScript. Example payload:

   <svg xmlns="http://www.w3.org/2000/svg" onload="fetch('/package-updates/install.cgi', {method:'POST', headers:{'Content-Type':'application/x-www-form-urlencoded'}, body:'module=shell&action=run&command=id'})">
   </svg>
   

   This payload would trigger a POST to the Webmin package-updates installer, attempting to execute a command in the context of the Webmin user (typically root).

3. Delivery: The attacker sends an email to the Webmin administrator's mailbox, attaching the SVG file. The email must be crafted so the MIME part for the attachment declares Content-Type: image/svg+xml; name="invoice.svg". The attacker sets the Content-Disposition: inline header in the MIME part.

4. Trigger: The administrator logs into Webmin, opens the mailboxes module, and clicks on the attachment to "detach" or "view" it. The detach.cgi endpoint streams the SVG with the attacker-controlled Content-Type. The browser renders the SVG and fires the onload handler.

5. Post-exploitation: The JavaScript executes with the administrator's full privileges. The attacker can:

   • Steal the session cookie (if not HttpOnly) and replay it from their own browser.
   • Read CSRF tokens from the DOM and forge authenticated requests to Webmin's command-execution endpoints (/proc/run.cgi), establishing a reverse shell.
   • Modify the Webmin config to disable authentication or install a persistent backdoor web shell.
   • Exfiltrate /etc/shadow or other sensitive files via a fetch to an attacker-controlled server.

The low EPSS score (0.00216, 12.1st percentile) suggests that at the time of writing this is not a heavily exploited CVE in the wild, but the attack chain is straightforward and requires only standard web-application skill to execute.

Impact Assessment

The CVSS 6.1 (Medium) severity understates the real risk in a Webmin context because Webmin is an administrative tool that typically runs with root or high-privilege service account permissions. A successful XSS gives the attacker an authenticated session in the administrator's browser, which is equivalent to full server compromise—Webmin provides a web-based shell (Command Shell module), file editor, and package manager. The lowest-privilege Webmin user account can still read/write any file the Webmin process can, which is nearly always root.

Blast radius:

• Confidentiality: Full file system read, including SSH keys, database credentials, and other application secrets.
• Integrity: Arbitrary file writes, command execution, configuration tampering, malware deployment.
• Availability: Ability to shut down services, destroy data, or brick the host.

Because the attack requires a click (UI:R), it is classified as user-interaction-dependent. However, the target is an administrator who is by definition likely to interact with email attachments through Webmin's mail module—making the interaction probability high. The C:C/CVSS score reflects a Medium severity, but organizational risk should be rated High given the privileged context of execution.

Detection Guidance

Sigma Rule

title: Webmin detach.cgi SVG Attachment XSS - CVE-2026-49102
id: 6a5c7e2f-9b4d-4c3a-8e1d-2f0c9b8a7d6e
status: experimental
description: Detects HTTP requests to Webmin mailboxes/detach.cgi serving image/svg+xml content
author: Valtersit Threat Intelligence
logsource:
  category: webserver
  product: apache
  service: accesslog
detection:
  selection:
    cs-method: 'GET'
    cs-uri-path|contains: '/mailboxes/detach.cgi'
    cs-uri-query|contains:
      - 'type=image/svg+xml'
      - 'Content-Type: image/svg+xml'
    sc-status: 200
  response:
    cs-content-type|contains: 'image/svg+xml'
  condition: selection and response
fields:
  - src_ip
  - cs-uri-query
  - cs-content-type
falsepositives:
  - Legitimate SVG viewing in Webmin mail module (pre-patch)
level: high

YARA Rule

rule Webmin_SVG_XSS_CVE_2026_49102
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects crafted SVG emails targeting Webmin mailboxes/detach.cgi"
        cve = "CVE-2026-49102"
        date = "2026-05-01"
        severity = "medium"
    strings:
        $svg_open = /<svg[^>]*xmlns=[\"']http:\/\/www\.w3\.org\/2000\/svg[\"']/ nocase
        $svg_script = /<script[^>]*>.*?<\/script>/s nocase
        $svg_event = /on(load|error|click|mouseover)\s*=\s*[\"'][^\"']*(fetch|XMLHttpRequest|eval|document\.cookie)/ nocase
        $mime_svg = "image/svg+xml"
        $content_disposition = "Content-Disposition: inline"
        $filename_svg = /name=[\"']?[^\"']*\.svg/i
    condition:
        $mime_svg and $content_disposition and $filename_svg and
        ( $svg_open or $svg_script or $svg_event )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-49102 Webmin mailboxes detach.cgi SVG XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/mailboxes/detach.cgi"; http_uri; content:"image/svg+xml"; http_header; content:"detach"; http_uri; sid:202649102; rev:1; classtype:attempted-user; metadata:created_at 2026-05-01, updated_at 2026-05-01;)

Elastic Detection

// Detect HTTP responses from Webmin detach.cgi with SVG MIME type
sequence by source.ip with maxspan=5s
  [ network where process.executable == "/usr/sbin/httpd" and
    url.path == "/mailboxes/detach.cgi" and
    url.query contains "image/svg+xml" ]
  [ http where process.executable == "/usr/sbin/httpd" and
    http.response.content_type == "image/svg+xml" and
    http.response.status_code == 200 ]

Splunk SPL Query

index=web sourcetype=access_combined uri_path="/mailboxes/detach.cgi" 
| rex field=uri_query "type=(?<mime_type>[^&]+)"
| where mime_type=="image/svg+xml" OR mime_type=="image%2Fsvg%2Bxml"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_query, status
| eval severity="MEDIUM", cve="CVE-2026-49102"
| table _time, src_ip, uri_query, status, count, severity, cve

Wazuh OSSEC Rule

<group name="webmin_xss,">
  <rule id="304915" level="12">
    <decoded_as>web</decoded_as>
    <match>mailboxes/detach.cgi</match>
    <regex>image/svg\+xml|image%2Fsvg%2Bxml</regex>
    <description>CVE-2026-49102: Webmin mailboxes/detach.cgi serving SVG (XSS risk)</description>
    <group>attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED (single OSV source claims patch in Webmin 2.640, not independently confirmed by a vendor advisory or NVD entry).

1. Immediate mitigation (if upgrade cannot be performed):

   • Disable the mailboxes module entirely via Webmin → Webmin Configuration → Module Configuration → delete or disable the "Mailboxes" module.
   • Place a reverse proxy (nginx, Apache mod_proxy) in front of Webmin and add a rule to reject or rewrite any request to /mailboxes/detach.cgi that includes image/svg+xml in the query string.
   • Force X-Content-Type-Options: nosniff and a strict CSP header at the reverse proxy level to prevent inline SVG script execution.
   • Restrict access to the Webmin port (10000) to trusted management IPs only via firewall rules.

2. Patch/upgrade:

   • Upgrade Webmin to version 2.640 or later using the built-in update manager (Webmin → Webmin Updates) or by downloading the new .deb/.rpm/tarball from the official Webmin site. Verify the fix by grepping the newer detach.cgi for image/svg+xml handling or the addition of Content-Disposition: attachment logic.
   • If the OSV-listed patch is not confirmed, also monitor the Webmin mailing list for an official advisory and apply any hotfix tarball provided.

3. Long-term hardening:

   • Run Webmin behind a VPN or bastion host; do not expose the management interface directly to the internet.
   • Enforce MFA on all Webmin accounts.
   • Implement a WAF (ModSecurity) with rules to block XSS payloads and unexpected MIME types in Webmin responses.
   • Regularly audit Webmin logs for anomalous requests to CGI endpoints, especially those containing script content in query strings.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-49102 (CWE-79, CVSS 6.1)
• OSV Advisory (patch source): https://osv.dev/vulnerability/CVE-2026-49102
• Webmin Official Site: https://www.webmin.com/ (release notes for version 2.640)
• Webmin GitHub Repository (changelog): https://github.com/webmin/webmin/commits/master (verify commit that addresses detach.cgi MIME handling)
• Shodan search reference for exposure census: https://www.shodan.io/search?query=http.title%3A%22Webmin%22

Threat actor activity: At the time of writing, CISA KEV does not list this CVE, and there are no publicly documented in-the-wild campaigns. The EPSS percentile (12.1%) indicates low current exploit probability. Monitor Valtersit's threat feed for updates if the patch is confirmed and exploit code begins circulating.