CVE-2025-61541
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
Webmin 2.510 is vulnerable to Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(), allowing an attacker to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.
Risk Assessment
Account takeover, including administrator accounts, can lead to unauthorized access to the system and its configuration.
Recommendation
Update Webmin to a patched version and configure the server to enforce a valid Host header value.
Other vulnerabilities in Webmin
See all- CVE-2026-124552Medium
Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, which renders table fields and COMMENT lines unescaped. Authenticated users with table edit permission can store JavaScript via savecmt.cgi or table entries that executes when other users, including root, view the list page.
- CVE-2017-15645High
CSRF exists in Webmin 1.850, allowing an attacker to execute arbitrary commands by sending a GET request to at/create_job.cgi with dir=/&cmd= in the URI.
- CVE-2017-15644High
There is an SSRF vulnerability in Webmin 1.850 that allows an attacker to exploit the PATH_INFO parameter to make a GET request to tunnel/link.cgi with an external IP address.
- CVE-2026-49243Critical
Webmin before version 2.650 contains an XSS vulnerability that can be exploited when a user clicks a malicious link to their server. An attacker can execute arbitrary commands in the user's context.
- CVE-2019-15107CriticalActively exploited
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
- CVE-2026-102337Medium
In Webmin prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not restricted by resolved IP address. This allows requests to unauthenticated intranet services or cloud-provider instance metadata endpoints inaccessible from the user's own system.
- CVE-2026-42210Medium
Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts requiring a second authentication factor (typically TOTP), an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication. As a workaround, apply the patch from commit da18a16c84ae5c0b78cad79609cb0efb174000ec manually.
- CVE-2026-56022Medium
Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.
- CVE-2026-56021Medium
Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.
- CVE-2026-56020High
The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. An attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.202.
Original NVD description (English source)
Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS