Webmin versions earlier than 2.640 construct filenames for saving mailbox attachments without sufficient validation. An attacker who can control the attachment download path could write arbitrary files to the server filesystem, potentially including executable scripts or web pages that bypass authentication. This flaw grants the ability to modify trusted locations and thus can lead to full compromise of the Webmin server.

The vulnerability affects all installations of Webmin, regardless of platform, that use a version prior to 2.640. Administrators should verify the exact release they are running and plan an upgrade accordingly.

The flaw has a CVSS score of 9.4, indicating high severity, and is currently not listed in CISA KEV and has no EPSS score available. The likely attack vector involves authenticated users who have permissions to trigger mailbox attachment downloads; an attacker with those privileges can supply crafted paths to cause the server to write files anywhere permitted by the process. The lack of an EPSS score suggests limited publicly known exploitation, but the high CVSS warrants immediate attention.