Fix module name validation in configuration pages

CHANGELOG.md

@@ -15,6 +15,7 @@
 * Fix native ext4 quota detection for filesystems mounted using `LABEL=` or `UUID=` identifiers [forum.virtualmin.com/t/137832](https://forum.virtualmin.com/t/137832)
 * Fix slave zone files staying empty on Debian and Ubuntu secondaries by creating BIND zone files owned by the `bind` user [forum.virtualmin.com/t/137767](https://forum.virtualmin.com/t/137767)
 * Fix Nginx Webserver module lock files not being released, causing saves to hang during long-running operations
+* Fix module name validation to prevent loading files outside installed modules
 
 #### 2.660 (August 20, 2026)
 * Add support for creating `vfsv1` Linux quota files for limits above 4 TiB, while preserving existing quota file formats

web-lib-funcs.pl

@@ -6532,7 +6532,7 @@ sub get_module_info
 {
 my ($mod, $noclone, $forcache) = @_;
 
-return () if ($mod =~ /^\./);
+return () if (!defined($mod) || $mod !~ /\A[A-Za-z0-9_-]+\z/);
 my (%rv, $clone, $o);
 my $mdir = &module_root_directory($mod);
 my $auto = load_language_auto();