CVE-2006-3392

no score yetEPSS 79%

Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.

EPSS: 79% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
Published: 2006-07-06
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

usermin:usermin
webmin:webmin

References

http://attrition.org/pipermail/vim/2006-July/000923.html
http://attrition.org/pipermail/vim/2006-June/000912.html
http://secunia.com/advisories/20892
http://secunia.com/advisories/21105
http://secunia.com/advisories/21365

Check your stack JSON