CVE-2023-38306

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-07-31 · updated 2026-06-17
Weakness: CWE-79

Description

An issue was discovered in Webmin 2.021. A Cross-site Scripting (XSS) Bypass vulnerability was discovered in the file upload functionality. Normally, the application restricts the upload of certain file types such as .svg, .php, etc., and displays an error message if a prohibited file type is detected. However, by following certain steps, an attacker can bypass these restrictions and inject malicious code.

Affected products

Webmin: 2.021

References

https://github.com/jaysharma786/Webmin-2.021/blob/main/CVE-2023-38306
https://webmin.com/tags/webmin-changelog/
https://github.com/jaysharma786/Webmin-2.021/blob/main/CVE-2023-38306
https://webmin.com/tags/webmin-changelog/

Get alerted when CVE-2023-38306 or the next vulnerability affects your stack