# CVE-2026-56021: Webmin information disclosure via regex bypass in module directories

Source: https://junglewise.ai/threats/cve-2026-56021-webmin-information-disclosure-via-regex-bypass-in-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-56021 · Severity: medium · CVSS 5.3 · Published 2026-06-18

Webmin, a web-based interface for system administration, contains a security flaw that allows unauthorized individuals to read configuration files. An attacker can access sensitive information stored in files ending in .conf within the application's module directories without needing a username or password. This could lead to the exposure of system settings or other internal data, potentially aiding further attacks.

Technologies: [Webmin](https://junglewise.ai/threats/technologies/webmin). Vendors: [Webmin](https://junglewise.ai/threats/vendors/webmin).

## Quick answers

**Is CVE-2026-56021 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56021 being exploited in the wild.

**How severe is CVE-2026-56021?** Medium severity, with a CVSS score of 5.3, published 18 June 2026.

**Which products and versions are affected?** Webmin prior to 2.641.

**Is there a fix for CVE-2026-56021?** A patch was published on 2026-05-11: Webmin version 2.641 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56021 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-56021?** Check whether you run Webmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in Webmin due to an incorrect regular expression (CWE-185) and a lack of anchors (CWE-777) in the pattern used to restrict file access. Unauthenticated attackers can exploit this flaw to bypass security checks and read any file ending in the .conf extension located within module directories. The attack is carried out over the network without requiring user interaction or prior authentication. This issue was addressed in Webmin version 2.641.

## Affected products

- Webmin Webmin prior to 2.641

## Timeline

- 2026-05-11: patched: Webmin version 2.641 released
- 2026-06-18: disclosed: CVE published to NVD

## References

- [https://github.com/webmin/webmin/releases/tag/2.641](https://github.com/webmin/webmin/releases/tag/2.641)
- [https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-02.json](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-02.json)
- [https://webmin.com/security/](https://webmin.com/security/)
- [https://www.cve.org/CVERecord?id=CVE-2026-56021](https://www.cve.org/CVERecord?id=CVE-2026-56021)

## Related threats

- [Webmin users file injection in cert_issue.cgi](https://junglewise.ai/threats/cve-2026-126781-webmin-through-2-670-contains-a-users-file-injection)
- [Webmin privilege escalation in ACL group module assignment](https://junglewise.ai/threats/cve-2026-126780-webmin-through-2-670-contains-a-privilege-escalation)
- [Webmin stored cross-site scripting in bind8 DNS records](https://junglewise.ai/threats/cve-2026-125392-webmin-through-2-670-contains-a-stored-cross-site-scripting)
- [Webmin OS command injection in samba/save_euser.cgi](https://junglewise.ai/threats/cve-2026-125391-webmin-through-2-670-contains-an-os-command-injection)
- [Webmin stored cross-site scripting in Shorewall modules](https://junglewise.ai/threats/cve-2026-124552-webmin-through-2-670-contains-a-stored-cross-site-scripting)