| Package | Affected versions | Patched versions |
|---|---|---|
| usermin | ≤ 1.210 | |
| webmin | ≤ 1.2.80 |
Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free