{"id":"CVE-2026-125392","kind":"vulnerability","aliases":["CVE-2026-125392"],"related":[],"title":"Webmin: stored script injection in DNS record editor via zone owners","description":"Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containing script that executes in an administrator's browser when viewing zone records.","summary":"Webmin through 2.670 does not HTML-escape raw DNS record values in the bind8 record editor when viewing in ALL mode. A delegated zone user, such as a Virtualmin domain owner, can store script that runs in an administrator's browser when that administrator views the zone records.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bind","runtime","self-hosted","virtualmin","webmin"],"not_affected_if":["bind8-module-disabled","no-delegated-zone-users"],"how_to_check":"- Check the installed Webmin version with `webmin --version` or the version shown on the Webmin dashboard, and compare it to the fixed release.\n- Confirm whether the BIND DNS module is in use and whether delegated zone users such as Virtualmin domain owners exist.","fix":"- Webmin: unknown (the sources name a patch on github.com but do not state a fixed version in the product data)","status":"open","published_at":"2026-11-10T00:17:13+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","triaged_at":"2026-11-10T00:30:27+00:00","updated_at":"2026-11-10T00:30:27+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-10T00:30:27Z","model":"claude-haiku-5-5","output":{"fix":"- Webmin: unknown (the sources name a patch on github.com but do not state a fixed version in the product data)","reach":"network","title":"Webmin: stored script injection in DNS record editor via zone owners","impact":"medium","summary":"Webmin through 2.670 does not HTML-escape raw DNS record values in the bind8 record editor when viewing in ALL mode. A delegated zone user, such as a Virtualmin domain owner, can store script that runs in an administrator's browser when that administrator views the zone records.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["webmin","virtualmin","bind","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in admin's browser, session tokens could be stolen","analyst_note":"Confirm the fixed Webmin version from the github.com patch link, since the product ranges do not state one.","how_to_check":"- Check the installed Webmin version with `webmin --version` or the version shown on the Webmin dashboard, and compare it to the fixed release.\n- Confirm whether the BIND DNS module is in use and whether delegated zone users such as Virtualmin domain owners exist.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-delegated-zone-users","bind8-module-disabled"],"who_is_affected":"Servers running Webmin up to and including 2.670 with the bind8 module enabled, especially hosts where customers or delegated users manage their own DNS zones through Virtualmin. The risk is to administrators who open the zone records in ALL view mode. Installations without delegated zone users have a much smaller exposure.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000776,"input_tokens":4610,"output_tokens":630,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125392':14A,17A '-2026':13A,16A '2.670':27B,76C 'administr':64B,69B,118C 'bind':18B 'bind8':39B 'bind8/edit_recs.cgi':86C 'browser':66B,120C 'contain':77C,112C 'cross':81C 'cross-sit':80C 'cve':12A,15A 'deleg':48B,100C 'dns':6A,34B,90C 'domain':55B,106C 'editor':8A,41B 'escap':32B,95C 'execut':115C 'host':22B 'html':31B,94C 'html-escap':30B 'inject':4A 'mode':46B,99C 'output':88C 'owner':11A,56B,107C 'raw':33B,89C 'record':7A,35B,40B,73B,91C,110C,124C 'run':61B 'runtim':19B 'script':3A,59B,83C,113C 'self':21B 'self-host':20B 'site':82C 'store':2A,58B,79C,109C 'user':50B,102C 'valu':36B,92C,111C 'via':9A 'view':43B,70B,98C,122C 'virtualmin':23B,54B,105C 'vulner':84C 'webmin':1A,24B,25B,74C 'without':93C 'zone':10A,49B,72B,101C,123C","nicknames":[],"mitigations":[],"who_affected":"Servers running Webmin up to and including 2.670 with the bind8 module enabled, especially hosts where customers or delegated users manage their own DNS zones through Virtualmin. The risk is to administrators who open the zone records in ALL view mode. Installations without delegated zone users have a much smaller exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bind","medium","runtime","selfhosted","virtualmin","webmin"],"campaign_type":null,"search_a":"'-125392':14A,17A '-2026':13A,16A 'cve':12A,15A 'dns':6A 'editor':8A 'inject':4A 'owner':11A 'record':7A 'script':3A 'store':2A 'via':9A 'webmin':1A 'zone':10A","search_b":"'2.670':27B 'administr':64B,69B 'bind':18B 'bind8':39B 'browser':66B 'deleg':48B 'dns':34B 'domain':55B 'editor':41B 'escap':32B 'host':22B 'html':31B 'html-escap':30B 'mode':46B 'owner':56B 'raw':33B 'record':35B,40B,73B 'run':61B 'runtim':19B 'script':59B 'self':21B 'self-host':20B 'store':58B 'user':50B 'valu':36B 'view':43B,70B 'virtualmin':23B,54B 'webmin':24B,25B 'zone':49B,72B","search_c":"'2.670':76C 'administr':118C 'bind8/edit_recs.cgi':86C 'browser':120C 'contain':77C,112C 'cross':81C 'cross-sit':80C 'deleg':100C 'dns':90C 'domain':106C 'escap':95C 'execut':115C 'html':94C 'mode':99C 'output':88C 'owner':107C 'raw':89C 'record':91C,110C,124C 'script':83C,113C 'site':82C 'store':79C,109C 'user':102C 'valu':92C,111C 'view':98C,122C 'virtualmin':105C 'vulner':84C 'webmin':74C 'without':93C 'zone':101C,123C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125392","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125392","severity":null,"published_at":"2026-11-10T00:17:13+00:00","modified_at":"2026-11-10T00:17:13+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","fetched_at":"2026-11-10T00:28:44+00:00","note":null}],"documents":[{"id":111581,"url":"https://github.com/webmin/webmin/commit/224cbd91467c98c3147df695fe9abc8149183356","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111582,"url":"https://www.vulncheck.com/advisories/webmin-through-2.670-stored-xss-via-bind8-edit-recs-cgi-all-view","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}