Vulnerability Description
Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privileged authenticated attackers to execute arbitrary JavaScript in the browser context of administrators by injecting unsanitized input stored in save_tmpl.cgi and rendered unescaped in list_tmpls.cgi.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Webmin | Webmin | < 2.641 |
Related Weaknesses (CWE)
References
- https://webmin.com/changelog/webmin-2.641-released/Release Notes
- https://www.vulncheck.com/advisories/webmin-stored-xss-via-system-and-server-staThird Party Advisory
FAQ
What is CVE-2026-22678?
CVE-2026-22678 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privileged authenticated attacke...
How severe is CVE-2026-22678?
CVE-2026-22678 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-22678?
Check the references section above for vendor advisories and patch information. Affected products include: Webmin Webmin.