Description
Webmin before 1.296 and Usermin before 1.226 do not properly handle a URL with a null ("%00") character, which allows remote attackers to conduct cross-site scripting (XSS), read CGI program source code, list directories, and possibly execute programs.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | webmin | 1.180-3sarge1 | DSA-1199-1 |
Advisories 1
- DSA-1199-1 webmin Debian Security (DSA / DLA) · Mar 9, 2026
References
- JVN#99776858 third-party-advisory
- 19820 vdb-entry
- 22114 third-party-advisory
- http://www.lac.co.jp/business/sns/intelligence/SNSadvisory_e/89_e.html
- ADV-2006-3424 vdb-entry
- 21690 third-party-advisory
- DSA-1199 vendor-advisory
- 28338 vdb-entry
- 22087 third-party-advisory
- 28337 vdb-entry
- MDKSA-2006:170 vendor-advisory
- 1016776 vdb-entry
- http://webmin.com/security.html
- 22556 third-party-advisory
- 1016777 vdb-entry
- webmin-usermin-source-disclosure(28699) vdb-entry