Webmin before version 2.640 is vulnerable to a cross‑site scripting attack via the mailboxes component’s detach.cgi endpoint. An attacker can create a malicious SVG document attachment that, when opened by a user, is served with the MIME type image/svg+xml instead of a safe type such as text/plain, allowing arbitrary JavaScript execution in the victim’s browser. Classed as CWE‑79, this flaw can lead to session hijacking, credential theft, defacement, or denial of service, compromising confidentiality, integrity, and availability of the affected system.

All Webmin installations running versions prior to 2.640 are impacted. The vulnerability is present in releases from 2.630 through 2.639, regardless of the underlying operating system. It affects any deployment that allows users to download or view mailbox attachments via the Webmin web interface.

The CVSS score of 6.1 indicates a medium severity that can be exploited remotely through the Webmin web interface. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires an attacker to craft and deliver a malicious SVG attachment to a user with access to the mailboxes component; it does not require elevated privileges or exploit code execution on the server side.