PT-2026-42550 · Webmin · Webmin

Hamed Kohi + 1 · CVE-2026-22678 · Published 2026-05-10 · Updated 2026-06-24

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Webmin versions prior to 2.641

Description A stored cross-site scripting issue exists in the email template description field of the System and Server Status module. Low-privileged authenticated attackers can execute arbitrary commands by injecting unsanitized input into the 'save tmpl.cgi' endpoint, which is subsequently rendered without escaping in the 'list tmpls.cgi' endpoint.

Recommendations Update to version 2.641 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-07880

CVE-2026-22678

Affected Products

Webmin

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22678.json · Exploit
• https://webmin.com/changelog/webmin-2.641-released · Patch
• https://bdu.fstec.ru/vul/2026-07880 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22678 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22678 · Vendor Advisory
• https://twitter.com/CyberEdition/status/2069842013126856988 · Twitter Post
• https://twitter.com/f1tym1/status/2069756122748047841 · Twitter Post
• https://twitter.com/seaarepea/status/2069889666573365568 · Twitter Post
• https://t.me/cveNotify/164474 · Telegram Post
• https://vulncheck.com/advisories/webmin-stored-xss-via-system-and-server-status · Note
• https://t.me/cveNotify/164660 · Telegram Post