Description
Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, which renders table fields and COMMENT lines unescaped. Authenticated users with table edit permission can store JavaScript via savecmt.cgi or table entries that executes when other users, including root, view the list page.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| webmin | webmin | ≤ 2.670 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
googlesky/CVE-2026-124552 ★ 0 · Nov 9, 2026
PoC for CVE-2026-124552 — Webmin <= 2.670 stored XSS in Shorewall/Shorewall6 list.cgi leading to RCE as root; includes an unpatched path traversal (arbitrary file write as root) found in the same mod…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- WID-SEC-2026-4390 Webmin: Schwachstelle ermöglicht Cross-Site Scripting BSI CERT-Bund (WID) · Nov 8, 2026
References
- GitHub Issue #2908 issue-tracking
- https://github.com/webmin/webmin product
- https://github.com/webmin/webmin/commit/01b988dbf1e8f9926eec4b041d913167e0cc280f patch
- https://github.com/webmin/webmin/blob/2.670/shorewall/list.cgi#L56-L78 technical-description
- https://github.com/webmin/webmin/blob/2.670/shorewall6/list.cgi#L58-L75 technical-description
- VulnCheck Advisory: Webmin through 2.670 Stored XSS via Shorewall and Shorewall6 list.cgi third-party-advisory