webmin 0.84 and previous versions allows local users to overwrite and create arbitrary files via a symlink attack.
webmin webmin 0.83