CVE-2026-22678
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module. Low-privileged authenticated attackers can execute arbitrary JavaScript in the browser context of administrators by injecting unsanitized input stored in save_tmpl.cgi and rendered unescaped in list_tmpls.cgi.
Risk Assessment
An attacker can hijack an administrator's session, perform malicious actions in the admin panel, or steal sensitive data.
Recommendation
Update Webmin to version 2.641 or later.
Original NVD description (English source)
Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privileged authenticated attackers to execute arbitrary JavaScript in the browser context of administrators by injecting unsanitized input stored in save_tmpl.cgi and rendered unescaped in list_tmpls.cgi.