CVE-2026-56021
Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.48%
- CWE
- CWE-185, CWE-777
- Published
- 2026-06-18
- Last modified
- 2026-06-24
Affected products
- Webmin Webmin
Weakness type
Related vulnerabilities
- CVE-2026-73425 — @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped
- CVE-2026-64655 — GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching
- CVE-2026-45065 — Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
- CVE-2026-47674 — Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
- CVE-2026-48147 — Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker
- CVE-2026-4296 — Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass
- CVE-2026-25542 — Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching
- CVE-2026-39350 — Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass