Because the input is processed in a vulnerable order, the underlying filesystem treats the sequence as a directory traversal instruction, enabling remote, unauthenticated attackers to disclose arbitrary files with root privileges. Given the release of functional exploit scripts, attackers can easily retrieve sensitive system files, including /etc/passwd, /etc/shadow, and cryptographic keys (e.g., /root/.ssh/id_rsa), significantly facilitating subsequent unauthorized access and privilege escalation.

Impact

The successful exploitation of this vulnerability results in the full disclosure of arbitrary files from the affected server. In environments where Webmin or Usermin are configured to run as root, this leads to complete information compromise, including the retrieval of local password hashes and private SSH keys, which can be leveraged to gain persistent administrative access to the host.

Recommendation

Prioritize patching or decommissioning legacy instances of Webmin and Usermin identified as vulnerable.

• Upgrade Webmin to version 1.290 or later, and Usermin to version 1.220 or later, to remediate the vulnerable 'simplify_path' logic.
• Audit network logs for requests containing the '..%01' sequence or other anomalous traversal patterns directed at Webmin or Usermin management ports (typically 10000).
• Inspect server access logs for repeated successful HTTP 200 responses to requests targeting sensitive system files like /etc/passwd or .ssh directories.
• Implement network-level restrictions to ensure management interfaces are not exposed to the public internet, as the vulnerability is exploitable by remote, unauthenticated actors.