The Read Mail module in Webmin 1.720 allows local users to read arbitrary files via a symlink attack on an unspecified file.