CVE-2026-22678: Webmin < 2.641 Stored XSS via System and Server Status

Q: What is the severity of CVE-2026-22678?

The severity of CVE-2026-22678 is medium, rated at 5.1.

Q: How do I fix CVE-2026-22678?

To fix CVE-2026-22678, upgrade Webmin to version 2.641 or later.

Q: What type of vulnerability is CVE-2026-22678?

CVE-2026-22678 is a stored cross-site scripting (XSS) vulnerability.

Q: Who is affected by CVE-2026-22678?

Low-privileged authenticated attackers can exploit CVE-2026-22678 to execute arbitrary commands.

Q: What component of Webmin is vulnerable in CVE-2026-22678?

The vulnerability in CVE-2026-22678 affects the email template description field of the System and Server Status module.

Published May 21, 2026

Updated

Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privileged authenticated attackers to execute arbitrary JavaScript in the browser context of administrators by injecting unsanitized input stored in savetmpl.cgi and rendered unescaped in listtmpls.cgi.

Affected Software

2 affected components

Webmin Webmin<2.641

Event History

May 21, 2026

CVE Published

via MITRE·08:59 PM

Data Sourced

via MITRE·08:59 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-22678?

The severity of CVE-2026-22678 is medium, rated at 5.1.

How do I fix CVE-2026-22678?

To fix CVE-2026-22678, upgrade Webmin to version 2.641 or later.

What type of vulnerability is CVE-2026-22678?

CVE-2026-22678 is a stored cross-site scripting (XSS) vulnerability.

Who is affected by CVE-2026-22678?

Low-privileged authenticated attackers can exploit CVE-2026-22678 to execute arbitrary commands.

What component of Webmin is vulnerable in CVE-2026-22678?