Vulnerability record · CVE-2006-3392 · published 6 July 2006
CVE-2006-3392: Webmin and Usermin path traversal allows arbitrary file read
Usermin · Usermin
Webmin before 1.290 and Usermin before 1.220 call simplify_path before decoding HTML, so crafted sequences such as "..%01" survive the removal of "../" and permit directory traversal. A remote attacker can therefore read files outside the intended web root, exposing configuration and credential material on the host.
Description
Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.
AV:N/AC:L/Au:N/C:P/I:N/A:N
Automated analysis
high priorityUnauthenticated remote file read with a very high EPSS score and known public discussion, though no KEV listing or confirmed in-the-wild exploitation is recorded.
What it is
Webmin before 1.290 and Usermin before 1.220 call simplify_path before decoding HTML, so crafted sequences such as "..%01" survive the removal of "../" and permit directory traversal. A remote attacker can therefore read files outside the intended web root, exposing configuration and credential material on the host.
Impact
An unauthenticated remote attacker gains read access to arbitrary files on the server, which can leak Webmin/Usermin configuration, password hashes and other sensitive data. There is no integrity or availability impact per the CVSS vector.
Attack surface
Reachable over the network via the Webmin/Usermin HTTP interface; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high (0.783, 99.6th percentile), and public advisories and mailing-list discussions exist, so exploitation is plausible and likely widespread.
What to do
- Upgrade Webmin to 1.290 or later and Usermin to 1.220 or later, or apply the vendor/distribution patches referenced in the advisories.
- Restrict network access to Webmin/Usermin management ports to trusted administrative networks only.
- Run Webmin/Usermin with least privilege and avoid storing plaintext credentials in files readable by the service.
- Monitor vendor and distribution advisories (Gentoo, Debian, Mandriva) for updated packages and apply them promptly.
Detection
- Inspect HTTP request logs for traversal patterns containing "..%01", "..%00" or similar encoded dot-dot sequences against Webmin/Usermin endpoints.
- Alert on requests for files outside the expected web root, especially configuration and password files.
- Correlate Webmin/Usermin access logs with unexpected reads of sensitive paths on the host.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-3392 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-3392), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
