Webmin Security Vulnerabilities Summary: RCE, XSS, SSRF, 2FA Bypass (CVE-2025/CVE-2026)

Webmin & Usermin Vulnerability Summary > This page lists security issues found in Webmin and Usermin, affected versions, and recommended solutions. --- 🐛 Found a Vulnerability? If you discover new security-related bugs, please report them to: security@webmin.com --- 🔒 Webmin Vulnerability Details ⚠️ Webmin prior to 2.652 SSRF exploit in Upload and Download and File Manager modules Unauthorized users can use the download feature to access URLs not accessible by the local system. Remediation: Administrators should restrict the URL range available for download by Webmin users (Webmin → Webmin Users → username → Permissions for all modules → URL download destinations). Credits: zuesdevil --- ⚠️ Webmin prior to 2.641 Stored XSS in System and Server Status module [CVE-2026-22678] Unauthorized users can create notification emails containing malicious templates, which trigger an XSS attack when viewed by the root user. Credits: Wade Sparks --- ⚠️ Webmin prior to 2.640 Privilege escalation using Help feature Unauthorized users can execute root commands via the built-in help page. Credits: Jeremy Brown XSS via SVG email attachment [CVE-2026-49102] Opening a malicious email with an SVG attachment can trigger XSS in the Read User Mail module. Credits: Andrea Carlo Maria Dattola, Marco Ventura, Massimiliano Broli (TIM Security Red Team Research - TIM S.p.A) Detach email attachment file overwrite [CVE-2026-49103] Webmin < 2.640 does not safely construct attachment save filenames, potentially leading to file overwrites. Credits: Same team as above. 2FA bypass using basic authentication [CVE-2026-42210, CVE-2026-56022] Accounts with 2FA enabled can be bypassed via Basic HTTP authentication (provided the username and password are correct). Credits: Same team as above. --- ⚠️ Webmin prior to 2.600 Privilege escalation using Squid module [CVE-2025-67738] If an unauthorized user has Squid module permissions and Squid cache manager is installed, parameter injection can be used to execute root commands. Credits: Filippo Decortes --- ⚠️ Webmin 2.510 and below [October 9, 2025] Host header injection vulnerability in the password reset feature [CVE-2025-61541] If the password reset feature is enabled, attackers can craft Host headers to include links to malicious sites in the reset email. Credits: Nyein Chan Aung, Mg Demon --- ⚠️ Webmin 2.202 and below [February 26, 2025] SSL certificates from clients may be trusted unexpectedly [CVE-2026-56020] If configured to trust remote IP addresses (via proxy), direct browser connections can spoof headers to trick the client certificate validation. Remediation: Upgrade to Webmin 2.301+ and enable the "Trust level for proxy headers" option on the page. Credits: Keigo YAMAZAKI (LAC Co., Ltd.) --- ⚠️ Webmin 2.105 and below [April 15, 2024] Privilege escalation by non-root users [CVE-2024-12828] Low-privilege users can leverage shell auto-completion vulnerabilities to execute commands as root. Remediation: All Virtualmin and Webmin administrators should upgrade to version 2.111 as soon as possible. Credits: Trend Micro’s Zero Day Initiative --- ⚠️ Webmin 1.995 and Usermin 1.850 and below [June 30, 2022] XSS vulnerability in the HTTP Tunnel module If low-privilege users are allowed to edit HTTP Tunnel configurations, they can inject vulnerabilities to capture other users' cookies. Credits: BLACK MENACE, PYBRO HTML emails can be used to capture browser cookies. Credits: ly1g3 --- ⚠️ Webmin 1.991 and below [April 18, 2022] Privilege escalation exploit [CVE-2022-30708] Low-privilege users (excluding Virtualmin and Cloudmin creators) can modify arbitrary files and run commands as root. Remediation: All systems with additional unauthorized users should be upgraded immediately. Credits: esp0xdeadbeef, V1s3r10n --- ⚠️ Webmin 1.984 and below [December 26, 2021] File Manager privilege exploit [CVE-2022-0824 and CVE-2022-0829] Users without File Manager module permissions can access root-owned files if using the default Authentic theme. Note: Virtualmin systems are not affected (due to different configuration methods). Credits: Faisal Fs (faisalfs10x) from NetbyteSEC --- 🛡️ Virtualmin Procmail wrapper version 1.0 Privilege escalation exploit The package version 1.0 has a vulnerability allowing any SSH user to gain root privileges. Remediation: All Virtualmin users should immediately upgrade to version 1.1 or higher. --- ⚠️ Webmin 1.973 and below [March 7, 2021] XSS vulnerabilities if Webmin is installed using the setup.pl script [CVE-2021-31760, CVE-2021-31761 and CVE-2021-31762] When installed via the script, referer checking is disabled by default, making it susceptible to XSS/CSRF attacks. Remediation: Add the following line to the file: Credits: Meshal (Mesh3L911), @Mesh3L911, Mohammed (Z0ldyck), @electron1cbots --- ⚠️ Webmin 1.941 and below [January 16, 2020] XSS vulnerability in the Command Shell module [CVE-2020-8820 and CVE-2020-8821] Users with permission to create custom commands can exploit unesc

Goal Reached Thanks to every supporter — we hit 100%!

Webmin Security Vulnerabilities Summary: RCE, XSS, SSRF, 2FA Bypass (CVE-2025/CVE-2026)