CVE-2026-124552

EUVD-2026-119608
Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, which renders table fields and COMMENT lines unescaped. Authenticated users with table edit permission can store JavaScript via savecmt.cgi or table entries that executes when other users, including root, view the list page.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.8 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
webminwebmin
𝑥
≤ 2.670
CNA
Common Weakness Enumeration
References
https://github.com/webmin/webmin
https://github.com/webmin/webmin/blob/2.670/shorewall/list.cgi#L56-L78
https://github.com/webmin/webmin/blob/2.670/shorewall6/list.cgi#L58-L75
https://github.com/webmin/webmin/commit/01b988dbf1e8f9926eec4b041d913167e0cc280f
https://github.com/webmin/webmin/issues/2908
https://www.vulncheck.com/advisories/webmin-through-2.670-stored-xss-via-shorewall-and-shorewall6-list-cgi