Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi.
The vulnerability classified as CWE-24 (path traversal) consists of the application not properly sanitizing the file name passed by the user when saving an email message attachment. The mailboxes/detachall.cgi script uses this unvalidated value directly to construct the target file path. An attacker can supply a crafted name containing sequences like '../' and cause the file to be written outside the intended directory.
An authenticated attacker can overwrite or create arbitrary files on the server with Webmin process privileges, which can lead to complete system takeover (e.g., by overwriting configuration files, startup scripts, or authorization keys).
Webmin should be updated to version 2.640 or newer. The patch is available in the project repository (commit cf432879a14568c4bb44cd2f9e5a9bd0e168edc1). Details of the changes comparison are available at: https://github.com/webmin/webmin/compare/2.630...2.640
Webmin before version 2.640
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X