CVE-2019-9624

ALTO 7.8CVE-2019-9624 · Published 07/03/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
webmin webmin	`= 1.900`	No fix yet

Description

Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted .cgi file via the /updown/upload.cgi URI.

References

rapid7.com/db/modules/exploit/unix/webapp/webmin_upload_exec · Third Party Advisory
pentest.com.tr/exploits/Webmin-1900-Remote-Command-Execution.html · Exploit
exploit-db.com/exploits/46201 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free