Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read…

Description

Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.

Scores

EPSS (exploitation in 30 days)

79.5% · top 0.4% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.0.

Weakness

• n/a

Affected products

• n/a

  • affected n/a

References (18)

• 21365 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• GLSA-200608-11 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• http://www.webmin.com/changes.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• 20060710 Re: Webmin / Usermin Arbitrary File Disclosure Vulnerability exploit (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 21105 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 18744 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• 20060715 Webmin / Usermin Arbitrary File Disclosure Vulnerability Perl (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 20060715 Re: Webmin / Usermin Arbitrary File Disclosure Vulnerability exploit (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• VU#999601 (opens in a new tab)third-party-advisoryx_refsource_CERT-VNx_transferred
• DSA-1199 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• 20060630 Webmin traversal - changelog (opens in a new tab)mailing-listx_refsource_VIMx_transferred
• 20892 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• MDKSA-2006:125 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• ADV-2006-2612 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 20060709 Webmin / Usermin Arbitrary File Disclosure Vulnerability exploit (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 26772 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 22556 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 20060711 Re: Webmin traversal - changelog (opens in a new tab)mailing-listx_refsource_VIMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2006-3392](https://trackcve.app/badge/CVE-2006-3392.svg)](https://trackcve.app/cve/CVE-2006-3392)

Record last updated 7 Aug 2024, 18:30 UTC.