Threats affecting pkg:github/webmin

CVE-2026-124552 is a stored cross-site scripting (XSS) vulnerability in Webmin versions up to 2.670, specifically affecting the Shorewall and Shorewall6 modules' list.cgi. Authenticated users with table edit permissions can inject JavaScript code via savecmt.cgi or table entries, which executes when other users, including root, view the affected list page. This vulnerability has a medium severity rating with a CVSS 4.8 score.