Description
Webmin through 2.670 contains a users file injection vulnerability in acl/cert_issue.cgi that allows authenticated Webmin users to inject lines by supplying unvalidated certificate DN fields containing newlines. Attackers can end a DN field with a backslash and newline to add a second root entry with a known password hash, gaining Webmin root access after miniserv restarts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| webmin | webmin | ≤ 2.670 | — |
Advisories 1
- WID-SEC-2026-4529 Webmin: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
References
- https://github.com/webmin/webmin/commit/0c449e341746d8c445c8c7db223eac1f41755943 patch
- https://github.com/webmin/webmin/commit/8fb194e5fbc30a6664545d48940d03759ace9bf2 patch
- https://github.com/webmin/webmin/blob/2.670/acl/cert_issue.cgi#L22-L52 technical-description
- VulnCheck Advisory: Webmin through 2.670 Users File Injection via acl/cert_issue.cgi third-party-advisory