PT-2026-42550 · Webmin · Webmin

Hamed Kohi + 1 · Published 2026-05-21 · Updated 2026-05-22 · CVE-2026-22678

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Webmin versions prior to 2.641

Description A stored cross-site scripting issue exists in the email template description field of the System and Server Status module. Low-privileged authenticated attackers can execute arbitrary commands by injecting unsanitized input into the 'save tmpl.cgi' endpoint, which is subsequently rendered without escaping in the 'list tmpls.cgi' endpoint.

Recommendations Update to version 2.641 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-22678

Affected Products

Webmin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-22678 · Security Note
• https://webmin.com/changelog/webmin-2.641-released · Patch
• https://t.me/cveNotify/164474 · Telegram Post
• https://t.me/cveNotify/164660 · Telegram Post
• https://vulncheck.com/advisories/webmin-stored-xss-via-system-and-server-status · Note