{"id":"CVE-2026-124552","kind":"vulnerability","aliases":["CVE-2026-124552"],"related":[],"title":"Webmin: stored script injection in Shorewall firewall module pages","description":"Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, which renders table fields and COMMENT lines unescaped. Authenticated users with table edit permission can store JavaScript via savecmt.cgi or table entries that executes when other users, including root, view the list page.","summary":"Webmin's Shorewall and Shorewall6 firewall modules display table fields and comment lines without escaping them. A user with table edit rights can store JavaScript that runs in the browser of other users, including root, when they view the list page.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux","self-hosted","shorewall","webmin"],"not_affected_if":["only-root-has-edit-rights","shorewall-not-used","webmin-newer-than-2.670"],"how_to_check":"- Check the installed Webmin version with `webmin --version` or the version shown in the Webmin footer; it is affected through `2.670`.\n- Check whether the Shorewall or Shorewall6 module is installed and used on the server.","fix":null,"status":"open","published_at":"2026-11-08T14:18:19+00:00","first_seen_at":"2026-11-08T14:48:42+00:00","triaged_at":"2026-11-08T14:51:02+00:00","updated_at":"2026-11-08T14:51:02+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-08T14:51:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Webmin: stored script injection in Shorewall firewall module pages","impact":"medium","summary":"Webmin's Shorewall and Shorewall6 firewall modules display table fields and comment lines without escaping them. A user with table edit rights can store JavaScript that runs in the browser of other users, including root, when they view the list page.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["webmin","shorewall","self-hosted","linux"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Injected script runs in an administrator's browser session","analyst_note":"Confirm the fixed Webmin version from the Patch link on github.com and the vulncheck advisory; sources here do not state one.","how_to_check":"- Check the installed Webmin version with `webmin --version` or the version shown in the Webmin footer; it is affected through `2.670`.\n- Check whether the Shorewall or Shorewall6 module is installed and used on the server.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["shorewall-not-used","webmin-newer-than-2.670","only-root-has-edit-rights"],"who_is_affected":"Servers running Webmin up to and including 2.670 with the Shorewall or Shorewall6 module in use. An attacker needs an account that can edit Shorewall tables, and a privileged user must then open the list page. Servers without these modules, or where only trusted administrators hold edit rights, carry less risk.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000754,"input_tokens":4613,"output_tokens":585,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124552':12A,15A '-2026':11A,14A '2.670':66C 'authent':90C 'browser':52B 'comment':34B,87C 'contain':67C 'cross':71C 'cross-sit':70C 'cve':10A,13A 'display':30B 'edit':43B,94C 'entri':103C 'escap':37B 'execut':105C 'field':32B,85C 'firewal':7A,28B 'host':20B 'includ':56B,109C 'infrastructur':16B 'inject':4A 'javascript':47B,98C 'line':35B,88C 'linux':17B 'list':62B,113C 'list.cgi':81C 'modul':8A,29B,80C 'page':9A,63B,114C 'permiss':95C 'render':83C 'right':44B 'root':57B,110C 'run':49B 'savecmt.cgi':100C 'script':3A,73C 'self':19B 'self-host':18B 'shorewal':6A,21B,25B,77C 'shorewall6':27B,79C 'site':72C 'store':2A,46B,69C,97C 'tabl':31B,42B,84C,93C,102C 'unescap':89C 'user':40B,55B,91C,108C 'via':99C 'view':60B,111C 'vulner':74C 'webmin':1A,22B,23B,64C 'without':36B","nicknames":[],"mitigations":[],"who_affected":"Servers running Webmin up to and including 2.670 with the Shorewall or Shorewall6 module in use. An attacker needs an account that can edit Shorewall tables, and a privileged user must then open the list page. Servers without these modules, or where only trusted administrators hold edit rights, carry less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","linux","medium","selfhosted","shorewall","webmin"],"campaign_type":null,"search_a":"'-124552':12A,15A '-2026':11A,14A 'cve':10A,13A 'firewal':7A 'inject':4A 'modul':8A 'page':9A 'script':3A 'shorewal':6A 'store':2A 'webmin':1A","search_b":"'browser':52B 'comment':34B 'display':30B 'edit':43B 'escap':37B 'field':32B 'firewal':28B 'host':20B 'includ':56B 'infrastructur':16B 'javascript':47B 'line':35B 'linux':17B 'list':62B 'modul':29B 'page':63B 'right':44B 'root':57B 'run':49B 'self':19B 'self-host':18B 'shorewal':21B,25B 'shorewall6':27B 'store':46B 'tabl':31B,42B 'user':40B,55B 'view':60B 'webmin':22B,23B 'without':36B","search_c":"'2.670':66C 'authent':90C 'comment':87C 'contain':67C 'cross':71C 'cross-sit':70C 'edit':94C 'entri':103C 'execut':105C 'field':85C 'includ':109C 'javascript':98C 'line':88C 'list':113C 'list.cgi':81C 'modul':80C 'page':114C 'permiss':95C 'render':83C 'root':110C 'savecmt.cgi':100C 'script':73C 'shorewal':77C 'shorewall6':79C 'site':72C 'store':69C,97C 'tabl':84C,93C,102C 'unescap':89C 'user':91C,108C 'via':99C 'view':111C 'vulner':74C 'webmin':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T14:18:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124552","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124552","severity":null,"published_at":"2026-11-08T14:18:19+00:00","modified_at":"2026-11-08T14:18:19+00:00","first_seen_at":"2026-11-08T14:48:42+00:00","fetched_at":"2026-11-08T14:48:42+00:00","note":null}],"documents":[{"id":102180,"url":"https://github.com/webmin/webmin/commit/01b988dbf1e8f9926eec4b041d913167e0cc280f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":102181,"url":"https://www.vulncheck.com/advisories/webmin-through-2.670-stored-xss-via-shorewall-and-shorewall6-list-cgi","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}