CVE-2026-56021: Webmin

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.

Affected products

• Webmin Webmin: before 1.290 (fixed in 1.290)

Published 2026-06-18. Last modified 2026-08-11.