CVE-2026-125392: Webmin through 2.670 Stored XSS via BIND8 edit_recs.cgi ALL View
Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/editrecs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containing script that executes in an administrator's browser when viewing zone records.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the stored script, and who is at risk of executing it?
A delegated zone user, such as a Virtualmin domain owner, can store a DNS record value containing script. The script executes when an administrator views the affected zone records in ALL view mode.
What access and interaction are required for exploitation?
The attacker needs privileges to create or modify DNS record values in a delegated zone. An administrator must then open the zone records using ALL view mode; exploitation requires this administrator interaction.
Are all DNS record views affected?
The provided information identifies the affected output path as bind8/edit_recs.cgi in ALL view mode. It does not establish that other views or output paths are affected.
How can I determine whether an instance is potentially affected?
Instances running Webmin through 2.670 are potentially affected if delegated users can store DNS record values and administrators use the BIND8 zone-record ALL view. Review those record values for untrusted HTML or script content and assess whether administrators have viewed the relevant zones.