CVE-2026-49103

No fix known EPSS <1%CVSS 9.4

Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi.

Published 2026-05-27 · CVE record · OSV

Products: webmin