CVE-2026-102337

Name of the Vulnerable Software and Affected Versions Webmin versions prior to 2.652

Description Untrusted users with access to the File Manager or Upload and Download modules can exploit the server-side URL download functionality to send requests to non-public network addresses. This occurs because the system does not restrict download destinations based on the resolved IP address, enabling access to unauthenticated intranet services or cloud-provider instance metadata endpoints that are otherwise inaccessible from the user's system.

Recommendations Update to version 2.652.