CVE-2026-125392 · Runtime
NO FIX YET · SEE WHAT TO DO
Webmin through 2.670 does not HTML-escape raw DNS record values in the bind8 record editor when viewing in ALL mode. A delegated zone user, such as a Virtualmin domain owner, can store script that runs in an administrator's browser when that administrator views the zone records.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Servers running Webmin up to and including 2.670 with the bind8 module enabled, especially hosts where customers or delegated users manage their own DNS zones through Virtualmin. The risk is to administrators who open the zone records in ALL view mode. Installations without delegated zone users have a much smaller exposure.
Not affected if bind8-module-disabled, no-delegated-zone-users
Who cares bind, self-hosted, virtualmin, webmin
webmin --version or the version shown on the Webmin dashboard, and compare it to the fixed release.Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containing script that executes in an administrator's browser when viewing zone records.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.