EUVD-2026-31350
GHSA-vxwv-pg73-pf78
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privileged authenticated attackers to execute arbitrary commands by injecting unsanitized input stored in save_tmpl.cgi and rendered unescaped in list_tmpls.cgi.
AnalysisAI
Stored cross-site scripting in Webmin before 2.641 allows low-privileged authenticated attackers to inject arbitrary JavaScript via the email template description field in the System and Server Status module. The payload is persisted through save_tmpl.cgi and rendered without HTML encoding by list_tmpls.cgi, executing in the browser of any user who subsequently views the template list - a population likely to include privileged administrators. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; a vendor-released patch (Webmin 2.641) is available.
Technical ContextAI
Webmin is a widely deployed web-based Unix/Linux system administration interface. The vulnerable code path resides in the System and Server Status module's email template management feature. CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) describes the root cause: user-supplied input in the template description field is accepted and persisted by save_tmpl.cgi without sanitization, then retrieved and rendered directly into the HTML page by list_tmpls.cgi without HTML encoding. This stored (persistent) XSS pattern is more dangerous than reflected XSS because the payload executes on every subsequent page load for every viewer, without any further attacker interaction after the initial injection. The CPE string cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:* covers all Webmin application versions, with the ENISA EUVD entry EUVD-2026-31350 bounding the affected range as Webmin 0 through below 2.641.
RemediationAI
The primary fix is upgrading to Webmin 2.641, which resolves this stored XSS as documented in the vendor changelog at https://webmin.com/changelog/webmin-2.641-released/. The VulnCheck advisory at https://www.vulncheck.com/advisories/webmin-stored-xss-via-system-and-server-status provides supplementary context. If immediate upgrade is not feasible, restrict access to the System and Server Status module - specifically the save_tmpl.cgi and list_tmpls.cgi endpoints - to only fully trusted administrator-level accounts, eliminating the low-privileged attacker role required for injection; this reduces attack surface but introduces operational constraints if delegated access is needed. Additionally, enforcing a strict Content Security Policy (CSP) header on the Webmin interface to block inline script execution would limit the impact of any XSS payload, though compatibility with Webmin's existing JavaScript functionality should be validated before deployment to avoid breaking legitimate administrative features.
An issue was discovered in Webmin <=1.920. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitabl
file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid
file/edit_html.cgi in Webmin 1.590 and earlier does not perform an authorization check before showing a file's unedited
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command. Rated critical severity (CVSS 9.8), thi
Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990. Rated high severity
In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root pr
SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/h
Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Dow
Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's ru
CSRF exists in Webmin 1.850. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authenticati
Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually creat
Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users fea
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today