CVE-2026-124552 Details
Description
Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, which renders table fields and COMMENT lines unescaped. Authenticated users with table edit permission can store JavaScript via savecmt.cgi or table entries that executes when other users, including root, view the list page.
A stored cross-site scripting vulnerability has been identified in Webmin versions through 2.670, specifically within the Shorewall and Shorewall6 modules. The issue resides in 'list.cgi', where table fields and COMMENT lines are rendered without proper escaping. This flaw allows authenticated users with table edit permissions to inject JavaScript via 'savecmt.cgi' or through table entries. The injected script executes when other users, including those with root privileges, view the list page.
Users can update to Webmin version 2.671 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/webmin/webmin | [email protected] | Vendor |
| https://github.com/webmin/webmin/blob/2.670/shorewall6/list.cgi#L58-L75 | [email protected] | Source CodeVendor |
| https://github.com/webmin/webmin/blob/2.670/shorewall/list.cgi#L56-L78 | [email protected] | Source CodeVendor |
| https://github.com/webmin/webmin/commit/01b988dbf1e8f9926eec4b041d913167e0cc280f | [email protected] | Source CodeVendor |
| https://github.com/webmin/webmin/issues/2908 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/webmin-through-2.670-stored-xss-via-shorewall-and-shorewall6-list-cgi | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Webmin | <= 2.670 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 8, 2026 | New CVE Received | [email protected] |