CVE-2026-124552— Webmin through 2.670 Stored XSS via Shorewall and Shorewall6 list.cgi

Quick assessment

Affected

webmin webmin

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Webmin 2.670 及更早版本在 Shorewall 和 Shorewall6 模块的 list.cgi 中存在存储型跨站脚本（XSS）漏洞。该漏洞导致表格字段和 COMMENT 行未进行转义处理。拥有表格编辑权限的已认证用户可通过 savecmt.cgi 或表格条目注入 JavaScript 代码，当其他用户（包括 root 用户）查看列表页面时，该代码将被执行。

CVSS 4.8 · Medium Updated Nov 08, 2026

Possible ATT&CK Techniques 2 AI

T1566 · Phishing T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Webmin through 2.670 Stored XSS via Shorewall and Shorewall6 list.cgi

Source: CVE Program / CVE List V5

Vulnerability Description

Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, which renders table fields and COMMENT lines unescaped. Authenticated users with table edit permission can store JavaScript via savecmt.cgi or table entries that executes when other users, including root, view the list page.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
webmin	webmin	0 ~ 2.670	-

II. Public POCs for CVE-2026-124552

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-124552

请登录查看更多情报信息。

Other References for CVE-2026-124552 (5)

https://github.com/webmin/webmin/blob/2.670/shorewall/list.cgi#L56-L78 technical-description
https://github.com/webmin/webmin/commit/01b988dbf1e8f9926eec4b041d913167e0cc280f patch
https://github.com/webmin/webmin/blob/2.670/shorewall6/list.cgi#L58-L75 technical-description
https://github.com/webmin/webmin/issues/2908 issue-tracking
https://www.vulncheck.com/advisories/webmin-through-2.670-stored-xss-via-shorewall-and-shorewall6-list-cgi third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-124552

IV. Related Vulnerabilities

Same product: webmin

Same vendor: webmin

Same weakness: CWE-79