This vulnerability is a Server‑Side Request Forgery that exists in Webmin versions prior to 2.652. The File Manager and Upload & Download modules allow an authenticated or unauthenticated user with module access to instruct Webmin to fetch a URL and store the result. Because the destination address is not validated against a whitelist of IP ranges, an attacker can point the download to internal network hosts or cloud‑metadata services that are normally inaccessible from the client. This can lead to unintentional disclosure of internal data, enumeration of internal services, and potentially read or modify data on systems reachable from the Webmin server.

Webmin, an open‑source web‑based system administration tool for Unix‑like servers. The vulnerability applies to all releases before 2.652. It affects any environment where the File Manager or Upload & Download modules are enabled and accessible to users who are not fully trusted.

The vulnerability carries a CVSS base score of 4.9, indicating moderate severity. No EPSS score is publicly available and the issue is not listed in CISA's KEV catalog, suggesting there is currently no high‑profile exploitation. Attackers can trigger the flaw via the web UI, requiring only that they have access to the vulnerable modules, which may be reachable from an exposed Webmin instance. Because the flaw allows connections to arbitrary internal hosts, the potential impact ranges from network reconnaissance to data exfiltration, depending on the target services.