CVE-2026-22678

Description

Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privileged authenticated attackers to execute arbitrary commands by injecting unsanitized input stored in save_tmpl.cgi and rendered unescaped in list_tmpls.cgi.

CVSS Vector

References

• https://webmin.com/changelog/webmin-2.641-released/
• https://www.vulncheck.com/advisories/webmin-stored-xss-via-system-and-server-status