critical9.4
CVE-2026-49103
Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component.
Impact
Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi.
Affected products
| Product | Affected versions |
|---|---|
| Webmin | before 2.640 |
Versions were read from the advisory text. No structured product data has been published for this record yet.