---
id: "CVE-2026-125392"
page: "https://infrastack.ai/live/CVE-2026-125392"
kind: "vulnerability"
aliases: ["CVE-2026-125392"]
title: "Webmin: stored script injection in DNS record editor via zone owners"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["bind", "runtime", "self-hosted", "virtualmin", "webmin"]
not_affected_if: ["bind8-module-disabled", "no-delegated-zone-users"]
published_at: "2026-11-10T00:17:13+00:00"
first_seen_at: "2026-11-10T00:28:44+00:00"
updated_at: "2026-11-10T00:30:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125392", "first_seen_at": "2026-11-10T00:28:44+00:00"}]
exploit_sources: []
---

# Webmin: stored script injection in DNS record editor via zone owners

Link for people: https://infrastack.ai/live/CVE-2026-125392 (this .md is for agents)

Webmin through 2.670 does not HTML-escape raw DNS record values in the bind8 record editor when viewing in ALL mode. A delegated zone user, such as a Virtualmin domain owner, can store script that runs in an administrator's browser when that administrator views the zone records.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Webmin version with `webmin --version` or the version shown on the Webmin dashboard, and compare it to the fixed release.
- Confirm whether the BIND DNS module is in use and whether delegated zone users such as Virtualmin domain owners exist.

## Fix

- Webmin: unknown (the sources name a patch on github.com but do not state a fixed version in the product data)

## Timeline

- 2026-11-10T00:28:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125392

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/webmin-through-2.670-stored-xss-via-bind8-edit-recs-cgi-all-view
- [fix] Patch: github.com https://github.com/webmin/webmin/commit/224cbd91467c98c3147df695fe9abc8149183356

## From the sources

Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containing script that executes in an administrator's browser when viewing zone records.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_