Webmin CVE-2026-22678

The attacker must hold a valid Webmin account with at least low-privileged access to the System and Server Status module's email template functionality, as confirmed by the CVSS 4.0 vector component PR:L. This is a non-trivial prerequisite - unauthenticated exploitation is not possible. A separate, higher-privileged user must subsequently navigate to the list_tmpls.cgi page to trigger payload execution, as confirmed by UI:P in the CVSS vector; exploitation cannot be forced unilaterally by the attacker after injection. The vulnerability is scoped specifically to the email template description field within the System and Server Status module - other Webmin modules are not stated to be affected. Deployments where low-privileged users are denied access to this module entirely, or where only a single administrator account exists, significantly reduce real-world exploitability beyond what the CVSS score implies.

The CVSS 4.0 base score of 5.1 (Medium) accurately captures meaningful real-world constraints. The vector AV:N/AC:L/AT:N/PR:L/UI:P indicates the attack is network-reachable with low complexity and no special attack requirements, but requires a low-privileged account (PR:L) and user interaction from a second party (UI:P). Modified scope impacts are limited - SC:L and SI:L indicate only limited confidentiality and integrity effects on the broader system. However, contextual risk in a system administration panel is meaningfully elevated beyond the raw score: the users most likely to trigger execution by viewing list_tmpls.cgi are administrators, whose sessions or actions carry far greater real-world impact than a standard user on a typical web application. No EPSS score was included in the available data, so exploitation probability cannot be quantified statistically. This CVE is not present in CISA KEV, confirming no publicly confirmed active exploitation at time of analysis. No public POC has been identified. The most significant real-world limiting factor is the PR:L requirement - an attacker must first obtain a valid Webmin account with module access - combined with the UI:P dependency on administrator action.

An attacker with a low-privileged Webmin account navigates to the System and Server Status module and creates or edits an email template, inserting a JavaScript payload (such as a session cookie exfiltration script) into the description field, which is saved via save_tmpl.cgi. When a higher-privileged administrator later opens the template management page at list_tmpls.cgi, the payload silently executes in their browser, potentially allowing the attacker to steal the admin's session token and gain full administrative control of the Webmin interface and the underlying server. No public POC has been identified at time of analysis.