How severe is CVE-2026-49103?

CVE-2026-49103 has a CVSS 4.0 base score of 9.4, rated critical severity.

Is CVE-2026-49103 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-49103?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2026-49103 have an EU (EUVD) identifier?

Yes. CVE-2026-49103 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-32532.

When was CVE-2026-49103 published?

CVE-2026-49103 was published on 2026-05-27 and last updated on 2026-06-17.

CVE-2026-49103

CVE-2026-49103 is a critical-severity vulnerability with a CVSS 4.0 base score of 9.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-24.

Key facts

Severity: Critical (CVSS 4.0 base score 9.4)
EPSS exploit prediction: 0% (22nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-32532
Weakness: CWE-24
Published: 2026-05-27
Last modified: 2026-06-17

Description

Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi.

Frequently asked questions

What is CVE-2026-49103?: Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi.
How severe is CVE-2026-49103?: CVE-2026-49103 has a CVSS 4.0 base score of 9.4, rated critical severity.
Is CVE-2026-49103 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-49103?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2026-49103 have an EU (EUVD) identifier?: Yes. CVE-2026-49103 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-32532.
When was CVE-2026-49103 published?: CVE-2026-49103 was published on 2026-05-27 and last updated on 2026-06-17.

References

Other CWE-24 vulnerabilities

CVE-2026-39813 — Critical (CVSS 9.8): A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through…
CVE-2025-61318 — Critical (CVSS 9.1): Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php…
CVE-2023-6699 — Critical (CVSS 9.1): The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all…
CVE-2025-54769 — High (CVSS 8.8): An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed…
CVE-2025-60344 — High (CVSS 8.6): A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote…
CVE-2026-40318 — High (CVSS 8.5): SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the…

Browse all CWE-24 vulnerabilities →