CVE-2026-56021

Executive Summary

CVE-2026-56021 is an information disclosure vulnerability in Webmin that allows unauthenticated remote attackers to read the contents of any file ending in .conf within Webmin module directories. The flaw stems from a bypassable regex pattern in the file-serving logic, enabling path traversal or pattern evasion to access sensitive configuration files. All Webmin installations are potentially affected, and the vulnerability is remotely exploitable over the network with no authentication required, exposing configuration data that may contain credentials, API keys, and internal network information.

Technical Analysis

The vulnerability resides in Webmin's HTTP request handling for module-based file serving. Webmin uses a regex pattern to validate file paths before serving them to clients, intended to restrict access to legitimate module assets (e.g., images, scripts, documentation). The pattern validates the requested file path against a whitelist or blacklist of allowed characters and directory traversal sequences.

The flaw is that the regex pattern is bypassable. Attackers can craft URL-encoded payloads or use alternative path representations that the regex fails to match but the underlying filesystem resolves correctly. Common bypass techniques include:

• URL encoding: %2e%2e/ for ../, %252e for double-encoded traversal, or encoding the .conf extension itself (e.g., %2econf).
• Path normalization discrepancies: Using backslashes (\) on Windows-based deployments, or trailing dots/spaces that Windows/Linux filesystems ignore.
• Null byte injection: Appending %00 to truncate the filename after the regex check.
• Alternate separators: Using //, ./, or /./ to normalize the path differently than the regex expects.

The regex specifically checks for filenames but fails to account for these encoding/normalization variations. On successful bypass, the attacker can request paths such as:

/module_path/../../etc/webmin/miniserv.conf
/module_path/..%2f..%2fetc%2fwebmin%2fconfig

The file-serving mechanism then reads the file from disk and returns its contents in the HTTP response. The limitation is that only files ending in .conf are readable — this still exposes a significant amount of sensitive configuration data, including:

• miniserv.conf — Webmin server configuration (ports, SSL settings, user database paths).
• Module-specific configs containing database credentials (e.g., MySQL, Postgres modules).
• webmin.conf / config — user authentication and access control data.
• VPN, mail server, firewall, and other module .conf files with embedded secrets.

CVSS 3.1 scoring reflects the modest confidentiality impact (C:L) with no integrity or availability impact, but the ease of exploitation (AV:N/AC:L/PR:N/UI:N) makes this a trivial target for scanning and mass exploitation.

Exploitation Scenarios

Step 1 — Reconnaissance: The attacker scans for Webmin instances using Shodan or mass port scanning on default TCP ports 10000 (HTTPS) and 10001 (HTTP). Target identification uses banners, favicon hashes, or login page titles.

Step 2 — Fingerprinting & Path Validation: The attacker sends a benign request to a known module asset to confirm Webmin version and module layout:

GET /proc/sysinfo.cgi HTTP/1.1
Host: target:10000

Response headers expose the Webmin version and confirm the application is running.

Step 3 — Regex Bypass Probe: The attacker sends various encoded traversal payloads to determine which bypass technique succeeds. Starting with the most common:

GET /unauthenticated/../../../../etc/webmin/miniserv.conf HTTP/1.1

If blocked, try URL-encoded variants:

GET /unauthenticated/..%2f..%2f..%2f..%2fetc%2fwebmin%2fminiserv.conf HTTP/1.1
GET /unauthenticated/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/webmin/miniserv.conf HTTP/1.1
GET /unauthenticated/..%252f..%252f..%252fetc%252fwebmin%252fminiserv.conf HTTP/1.1

Step 4 — Data Exfiltration: When a payload succeeds, the HTTP response body contains the target file contents. The attacker harvests:

• miniserv.conf → user database location, SSL key paths, session timeout values.
• Module config files → cleartext or obfuscated passwords for managed services.
• webmin.conf → authentication realm and ACL details.

Step 5 — Post-Exploitation: With credentials extracted from .conf files (e.g., MySQL root passwords, mail server credentials), the attacker pivots to other infrastructure components. Alternatively, if the .conf reveals the path to the passwd file or user database, the attacker can attempt credential stuffing against the Webmin login to gain authenticated access.

Impact Assessment

Business Impact: The vulnerability enables unauthenticated information disclosure of sensitive configuration files. The primary impact is the exposure of internal infrastructure details, embedded credentials, and service configurations. This leads to:

• Credential leakage for linked services (databases, mail servers, VPNs), enabling lateral movement.
• Infrastructure fingerprinting for targeted follow-up attacks against specific services.
• Compliance violations related to data protection (if configuration data contains PII or regulated data).

Affected Systems: All Webmin installations exposed to untrusted networks. This includes internet-facing servers, DMZ hosts, and internal network segments where Webmin is used for server administration. Given the default port 10000 is commonly exposed for remote administration, the attack surface is significant.

Blast Radius: The CVSS subscores highlight a narrow but impactful scope — confidentiality impact is Low but unauthenticated and remotely accessible. The attack vector is network-based with low complexity, meaning automated scanning and mass exploitation are feasible. The Practical effects include:

• Direct read of configuration files (C:L).
• Chain escalation when credentials are reused (I:H can be realized through subsequent attacks).
• No user interaction or special conditions required (UI:N).

In practice, a single HTTP request is sufficient to exfiltrate sensitive data, making this a high-priority finding despite the medium CVSS base score.

Detection Guidance

Sigma Rule

title: Webmin Conf File Information Disclosure Attempt
id: 3c9b4f2e-8d7a-4b6e-9a1f-2c4d6e8f0a1b
status: experimental
description: Detects traversal attempts targeting .conf files in Webmin
logsource:
  category: webserver
  product: webmin
detection:
  selection:
    cs-method: GET
    cs-uri-query|contains|all:
      - '.conf'
      - '..'
  filter_known:
    cs-uri-query|startswith:
      - '/images/'
      - '/unauthenticated/'
  condition: selection and not filter_known
falsepositives:
  - Legitimate admin requests to module config files
level: high

Note: The rule above relies on raw request patterns. Most Webmin access logs will not include the decoded path; use web server (Apache/Nginx reverse proxy) access logs with %{X-Forwarded-For}i to capture encoded payloads.

YARA Rule

rule Webmin_Conf_Traversal_Attempt
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects URL-encoded path traversal attempts targeting .conf files in Webmin"
        cve = "CVE-2026-56021"
        date = "2026-06-01"
        severity = "High"

    strings:
        $traversal1 = "..%2f" nocase
        $traversal2 = "%2e%2e%2f" nocase
        $traversal3 = "..%5c" nocase
        $conf_ext = ".conf" nocase
        $conf_enc = "%2econf" nocase

    condition:
        any of ($traversal*) and any of ($conf*)
}

Note: YARA rule targets HTTP request lines (e.g., from PCAP extraction or proxy logs). Adjust for your logging pipeline (e.g., match against full URI with unifiied logging format).

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Webmin .conf File Traversal Attempt (CVE-2026-56021)"; flow:established,to_server; http.request_line; content:"GET"; http.uri; content:".conf"; distance:0; pcre:"/(?:\.\.%2f|%2e%2e%2f|\.\.\\/|\.\.\/)/i"; classtype:attempted-recon; sid:20265602101; rev:1;)

Explanation: Rule triggers on HTTP GET requests containing .conf combined with traversal indicators. Uses PCRE for flexibility across encoding schemes.

Elastic Detection

any where process.network.direction == "inbound" and
  process.parent.name == "miniserv.pl" and
  process.name == "stunnel" or
  http.request.method == "GET" and
  http.request.body.content : ("*..%2f*.conf*", "*%2e%2e%2f*.conf*", "*..%5c*.conf*")

Splunk SPL Query

index=webmin sourcetype="webmin:access"
| search uri="*/../*.conf*" OR uri="*..%2f*.conf*" OR uri="*%2e%e%2f*.conf*" OR uri="*..%5c*.conf*"
| stats count by clientip, uri, status
| sort - count
| table _time, clientip, uri, status, count

Explanation: Searches Webmin access logs (or reverse proxy logs) for requests containing .conf combined with traversal sequences. Adjust index/sourcetype to match your deployment.

Wazuh OSSEC Rule

<rule id="100601" level="12">
  <decoded>apache-accesslog</decoded>
  <match>GET /</match>
  <regex>\.\.%2f|%2e%2e%2f|\.\./|\.\.\\</regex>
  <regex>\.conf</regex>
  <description>Webmin .conf file traversal attempt (CVE-2026-56021)</description>
  <group>webmin_exploit,traversal,</group>
</rule>

Note: Assumes webmin access logs are ingested into OSSEC via Apache accesslog decoder or custom decoder. Adjust regex to match your log format.

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED. A single source (OSV) claims a patch exists, but no official vendor advisory has been published independently at the time of this report. The affected version range is marked as "unfixed" in OSV packages, and no patch version was confirmed.

Immediate Mitigations (no patch available):

1. Network Access Control: Restrict access to Webmin (port 10000/10001) to trusted IP ranges only via firewall rules. Do not expose Webmin to the internet.
2. Reverse Proxy Filtering: Deploy a reverse proxy (nginx, Apache) in front of Webmin and block any request URI containing ..%2f, %2e%2e, .conf with encoded traversal, or raw ../.
3. Web Application Firewall: Configure a WAF rule to block traversal payloads targeting .conf files:
   • Block URIs matching: .*(\.\.[\\/]|%2e%2e%2f|%2e%2e[\\/]|[\\/]\.\.).*\.conf.*
4. Disable Unused Modules: If certain modules are not in use, disable them via Webmin UI to reduce the number of accessible directory paths.
5. Monitor Access Logs: Immediately review Webmin access logs for patterns matching the detection queries above, and investigate any hits for data exposure.

Patch/Upgrade Steps:

1. Monitor the official Webmin GitHub repository and mailing list for an advisory.
2. Once patched version is released, upgrade via: cpanm Webmin if installed via CPAN, apt update && apt upgrade webmin for Debian/Ubuntu, or yum update webmin for RHEL/CentOS.
3. If you downloaded from the Webmin website, re-download and replace the affected files from the vendor-provided source.
4. After upgrading, verify the regex pattern change by attempting to access /etc/webmin/miniserv.conf through the web interface — it should return 404.

Long-Term Hardening:

• Regular Updates: Subscribe to Webmin security notifications and apply patches promptly.
• Isolation: Run Webmin in a container or VM with minimal host access; use SELinux/AppArmor profiles to restrict file access.
• Least Privilege: Limit the OS user under which miniserv.pl runs to only required directories (e.g., /etc/webmin/ only, not /etc/ globally).
• Harden Configuration: Disable modules that are not required. Ensure no .conf files containing credentials are stored under module directories.
• Credential Rotation: If you suspect prior exposure, rotate all passwords/keys found in Webmin .conf files immediately.
• Network Segmentation: Place Webmin behind a VPN and disable direct internet exposure.
• Logging & SIEM Integration: Ensure Webmin access logs and OS level audit logs are forwarded to a SIEM for ongoing monitoring.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-56021 (Official CVE details, CVSS score, and description).
2. Oval/OSV Database: https://osv.dev/vulnerability/CVE-2026-56021 (Patch claim source, affected version "unfixed" status).
3. Webmin Official Site: https://www.webmin.com/ (Monitor for vendor advisory and patched releases).
4. Webmin GitHub Repository: https://github.com/webmin/webmin (Source code repository for patching and commit history review).
5. MITRE ATT&CK T1083 — File and Directory Discovery: https://attack.mitre.org/techniques/T1083/ (Relevant technique for post-exploitation information gathering).

Threat Actor Campaigns: At the time of this publication, no known in-the-wild exploitation campaigns have been publicly documented for CVE-2026-56021. However, the vulnerability class (unauthenticated file read via regex bypass) has been previously exploited in related Webmin CVEs (e.g., CVE-2019-15107), and automated scanning for Webmin panels is a common activity by botnets and opportunistic attackers. The public PoC availability elevates the real-world exploitability likelihood.