CVE-2026-124552 in Webmin
Summary
by MITRE • 11/08/2026
Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, which renders table fields and COMMENT lines unescaped. Authenticated users with table edit permission can store JavaScript via savecmt.cgi or table entries that executes when other users, including root, view the list page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/08/2026
The vulnerability identified in Webmin versions up to 2.670 represents a significant security risk within the system administration interface, specifically affecting the Shorewall and Shorewall6 modules. This flaw is classified as a stored cross-site scripting (XSS) issue located within the list.cgi script component. The core technical deficiency lies in the improper handling of user-supplied input during the rendering process for table fields and COMMENT lines. Instead of applying appropriate output encoding or escaping mechanisms, the application directly injects these values into the HTML response without sanitization. This lack of validation allows malicious scripts to be persisted within the database-backed configuration entries rather than being executed transiently through a single request, which distinguishes it from reflected XSS attacks.
The operational impact is severe because the vulnerability requires authentication and specific table edit permissions to exploit initially, but the consequences extend far beyond the attacker's own session. An authenticated user with write access can inject JavaScript payloads by saving comments or modifying table entries via savecmt.cgi or direct database manipulation. Once stored, these malicious scripts are executed automatically whenever any other user accesses the list page associated with the affected module. This includes high-privilege accounts such as root users who routinely monitor firewall configurations and network states. Consequently, an attacker can hijack administrative sessions, steal sensitive cookies or session tokens, perform actions on behalf of victims, or redirect users to malicious external sites designed for further exploitation or credential harvesting.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The stored nature of the attack also correlates with CWE-83, where data is received from an upstream component and not validated before being used in a web page. In terms of adversary tactics, this exploit maps to MITRE ATT&CK technique T1059, specifically Command Line Interface or Web Browser-based execution depending on how the script interacts with the victim's browser environment, and potentially T1271 for HTML Injection if the payload is designed to manipulate the DOM structure directly. The persistence of the code means that remediation requires not only patching the software but also auditing existing configurations for any injected malicious content that may have been stored prior to the update.
Mitigation strategies should prioritize immediate upgrading to Webmin version 2.671 or later, where this input validation and output encoding issue has been resolved by developers. In environments where an upgrade is not immediately feasible, administrators can implement a compensating control by restricting access to the Shorewall modules to only those users who absolutely require it, thereby reducing the attack surface for authenticated attackers. Additionally, deploying a Web Application Firewall with rules capable of detecting and blocking common XSS payloads in POST requests directed at savecmt.cgi or list endpoints may provide temporary protection against exploitation attempts while patching efforts are underway. Regular security audits of configuration files can also help identify any residual malicious scripts that were injected during the window of vulnerability exposure.