From 2f4f017acfd4bf0c739edd4bbc0ce78126f6ba01 Mon Sep 17 00:00:00 2001
From: Ilia Ross <ilia@ross.gdn>
Date: Fri, 11 Sep 2026 17:34:17 +0200
Subject: [PATCH] Fix module name validation in configuration pages

---
 CHANGELOG.md     | 1 +
 web-lib-funcs.pl | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index af51113da..26bec8d9a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,7 @@
 * Fix native ext4 quota detection for filesystems mounted using `LABEL=` or `UUID=` identifiers [forum.virtualmin.com/t/137832](https://forum.virtualmin.com/t/137832)
 * Fix slave zone files staying empty on Debian and Ubuntu secondaries by creating BIND zone files owned by the `bind` user [forum.virtualmin.com/t/137767](https://forum.virtualmin.com/t/137767)
 * Fix Nginx Webserver module lock files not being released, causing saves to hang during long-running operations
+* Fix module name validation to prevent loading files outside installed modules
 
 #### 2.660 (August 20, 2026)
 * Add support for creating `vfsv1` Linux quota files for limits above 4 TiB, while preserving existing quota file formats
diff --git a/web-lib-funcs.pl b/web-lib-funcs.pl
index 2b3eff992..197a2c14e 100755
--- a/web-lib-funcs.pl
+++ b/web-lib-funcs.pl
@@ -6532,7 +6532,7 @@ sub get_module_info
 {
 my ($mod, $noclone, $forcache) = @_;
 
-return () if ($mod =~ /^\./);
+return () if (!defined($mod) || $mod !~ /\A[A-Za-z0-9_-]+\z/);
 my (%rv, $clone, $o);
 my $mdir = &module_root_directory($mod);
 my $auto = load_language_auto();