{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awebminusermin/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*","cpe:2.3:a:webmin:usermin:*:*:*:*:*:*:*:*","cpe:2.3:a:usermin:usermin:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2006-3392"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Webmin (\u003c= 1.280)","Usermin (\u003c= 1.210)"],"_cs_severities":["medium"],"_cs_tags":["vulnerability","path-traversal","webmin"],"_cs_type":"advisory","_cs_vendors":["Webmin"],"content_html":"\u003cp\u003eCVE-2006-3392 is a path traversal vulnerability affecting Webmin versions prior to 1.290 and Usermin versions prior to 1.220. The flaw resides in the 'simplify_path' function, which incorrectly processes path strings before HTML decoding. This logic allows attackers to bypass security filters - specifically the removal of '../' sequences - by using malformed input such as '..%01'.\u003c/p\u003e\n\u003cp\u003eBecause the input is processed in a vulnerable order, the underlying filesystem treats the sequence as a directory traversal instruction, enabling remote, unauthenticated attackers to disclose arbitrary files with root privileges. Given the release of functional exploit scripts, attackers can easily retrieve sensitive system files, including /etc/passwd, /etc/shadow, and cryptographic keys (e.g., /root/.ssh/id_rsa), significantly facilitating subsequent unauthorized access and privilege escalation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of this vulnerability results in the full disclosure of arbitrary files from the affected server. In environments where Webmin or Usermin are configured to run as root, this leads to complete information compromise, including the retrieval of local password hashes and private SSH keys, which can be leveraged to gain persistent administrative access to the host.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize patching or decommissioning legacy instances of Webmin and Usermin identified as vulnerable.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Webmin to version 1.290 or later, and Usermin to version 1.220 or later, to remediate the vulnerable 'simplify_path' logic.\u003c/li\u003e\n\u003cli\u003eAudit network logs for requests containing the '..%01' sequence or other anomalous traversal patterns directed at Webmin or Usermin management ports (typically 10000).\u003c/li\u003e\n\u003cli\u003eInspect server access logs for repeated successful HTTP 200 responses to requests targeting sensitive system files like /etc/passwd or .ssh directories.\u003c/li\u003e\n\u003cli\u003eImplement network-level restrictions to ensure management interfaces are not exposed to the public internet, as the vulnerability is exploitable by remote, unauthenticated actors.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T04:44:18Z","date_published":"2026-10-14T04:44:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2006-3392/","summary":"A path traversal vulnerability in Webmin and Usermin allows remote, unauthenticated attackers to read arbitrary files by exploiting improper input handling in the simplify_path function.","title":"Path Traversal in Webmin and Usermin (CVE-2006-3392)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2006-3392/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:webmin:usermin:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}