---
id: "CVE-2026-124552"
page: "https://infrastack.ai/live/CVE-2026-124552"
kind: "vulnerability"
aliases: ["CVE-2026-124552"]
title: "Webmin: stored script injection in Shorewall firewall module pages"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "linux", "self-hosted", "shorewall", "webmin"]
not_affected_if: ["only-root-has-edit-rights", "shorewall-not-used", "webmin-newer-than-2.670"]
published_at: "2026-11-08T14:18:19+00:00"
first_seen_at: "2026-11-08T14:48:42+00:00"
updated_at: "2026-11-08T14:51:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124552", "first_seen_at": "2026-11-08T14:48:42+00:00"}]
exploit_sources: []
---

# Webmin: stored script injection in Shorewall firewall module pages

Link for people: https://infrastack.ai/live/CVE-2026-124552 (this .md is for agents)

Webmin's Shorewall and Shorewall6 firewall modules display table fields and comment lines without escaping them. A user with table edit rights can store JavaScript that runs in the browser of other users, including root, when they view the list page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Webmin version with `webmin --version` or the version shown in the Webmin footer; it is affected through `2.670`.
- Check whether the Shorewall or Shorewall6 module is installed and used on the server.

## Timeline

- 2026-11-08T14:48:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124552

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/webmin-through-2.670-stored-xss-via-shorewall-and-shorewall6-list-cgi
- [fix] Patch: github.com https://github.com/webmin/webmin/commit/01b988dbf1e8f9926eec4b041d913167e0cc280f

## From the sources

Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, which renders table fields and COMMENT lines unescaped. Authenticated users with table edit permission can store JavaScript via savecmt.cgi or table entries that executes when other users, including root, view the list page.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_