Threats affecting pkg:github/webmin/webmin

Webmin versions up to 2.670 contain a stored cross-site scripting (XSS) vulnerability in the bind8/edit_recs.cgi component. This flaw allows delegated zone users, such as Virtualmin domain owners, to inject script code into DNS record values that are not properly HTML escaped in ALL view mode. When an administrator views these zone records, the malicious script executes in their browser.

CVE-2026-125391 is an OS command injection vulnerability in Webmin versions up to 2.670. It affects the samba/save_euser.cgi component, allowing authenticated Samba user maintainers to inject arbitrary OS commands via the unvalidated opts parameter. This can lead to command execution with root privileges.

A cross-site scripting (XSS) vulnerability has been identified in Webmin, a modular web application used for Unix-based system administration and service configuration. The vulnerability affects Webmin versions up to and including 2.670. No CVSS score or detailed impact information is provided.

Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not restricted by resolved IP address. This allows requests to unauthenticated intranet services or cloud-provider instance metadata endpoints that are inaccessible from the user's own system. This issue is fixed in 2.652.