Medium severity5.3NVD Advisory· Published Jun 18, 2026· Updated Aug 11, 2026

CVE-2026-56021

Description

Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Webmin/Webmin2 versions
cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*range: <1.290
- (no CPE)

Patches

Vulnerability mechanics

References

webmin.com/security/nvdVendor Advisory
github.com/webmin/webmin/releases/tag/2.641nvdProductRelease Notes
raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-02.jsonnvdVDB Entry
www.cve.org/CVERecordnvdVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000