CVE-2026-124552: Webmin through 2.670 Stored XSS via Shorewall and Shorewall6 list.cgi
Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, which renders table fields and COMMENT lines unescaped. Authenticated users with table edit permission can store JavaScript via savecmt.cgi or table entries that executes when other users, including root, view the list page.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated Webmin user must have permission to edit Shorewall or Shorewall6 tables. They can store malicious JavaScript in COMMENT lines through savecmt.cgi or in table entries.
Who is at risk from the stored script?
Any user who views the affected Shorewall or Shorewall6 list page can trigger the stored script, including the root user. The impact depends on the privileges of the user viewing that page.
Does this affect a default Webmin installation?
The issue requires the Shorewall or Shorewall6 modules to be used and an authenticated user to have table edit permission. The provided information does not establish whether those conditions are present by default.
How can I determine whether my deployment is affected?
Check whether Webmin is version 2.670 or earlier and whether the Shorewall or Shorewall6 modules are in use. Review which authenticated users have permission to edit their tables, and inspect COMMENT lines and table entries for unexpected HTML or JavaScript.