Critical Webmin Vulnerabilities Expose Root Access and Bypass 2FA A critical stored cross-site scripting (XSS) vulnerability in Webmin, the popular web-based Unix system administration tool, has been disclosed, allowing untrusted users to compromise root-level accounts through malicious notification email templates. Tracked as CVE-2026-22678, the flaw affects all Webmin versions prior to 2.641 and resides in the System and Server Status module. The vulnerability enables attackers with permission to create email templates to inject malicious scripts that execute with root privileges when viewed. This poses a severe risk in multi-tenant or enterprise environments, where administrative access is often delegated to less-privileged users. Since the payload is stored on the server, root accounts can be silently compromised during routine administrative tasks without requiring direct interaction. Security researcher Wade Sparks responsibly disclosed the flaw, which was patched in Webmin 2.641. The update also addressed three additional vulnerabilities reported by Andrea Carlo Maria Dattola, Marco Ventura, and Massimiliano Brolli: - CVE-2026-49102 – XSS via SVG email attachments in the Read User Mail module, potentially exposing session tokens and user data. - CVE-2026-49103 – Arbitrary file overwrite in the Read User Mail module due to unsafe filename handling. - CVE-2026-42210 / CVE-2026-56022 – 2FA bypass via Basic HTTP authentication, allowing attackers to circumvent multi-factor authentication with only valid credentials. An additional privilege escalation flaw in Webmin’s Help feature, which allowed untrusted users to execute root-level commands regardless of permissions, was also patched without a CVE assignment. The vulnerabilities highlight systemic risks in Webmin’s permission delegation model, particularly in hosting environments where Webmin or Virtualmin manages multiple domains with separate user credentials. The 2FA bypass flaw is especially concerning, as it weakens a critical security layer and could facilitate credential stuffing or phishing attacks against administrators. Affected and Fixed Versions: - CVE-2026-22678 – Fixed in Webmin 2.641 - CVE-2026-49102, CVE-2026-49103, CVE-2026-42210 / CVE-2026-56022 – Fixed in Webmin 2.640 Administrators are urged to upgrade immediately to mitigate these risks.

Critical Stored XSS Vulnerability in Webmin Exposes Systems to Privilege Escalation A newly disclosed stored cross-site scripting (XSS) vulnerability in Webmin, tracked as CVE-2026-22678, allows attackers with limited privileges to compromise root users on affected systems. The flaw resides in the System and Server Status module, a core component used for monitoring and alert management in Webmin versions prior to 2.641. The vulnerability stems from improper input sanitization in notification email templates. An authenticated but untrusted Webmin user with permissions to create or modify these templates can inject malicious JavaScript payloads. When a privileged user including root views the altered template, the script executes in their browser, enabling a stored XSS attack. Unlike reflected XSS, this exploit is persistent, meaning the payload remains embedded in the server and triggers whenever a privileged user accesses the affected module. Successful exploitation could lead to session hijacking, credential theft, or unauthorized administrative actions, effectively granting attackers full system control under the context of a root session. Real-world risks include system compromise, data exfiltration, and lateral movement within networks. Security researcher Wade Sparks discovered and reported the flaw, which was acknowledged by the Webmin development team in an April 25, 2024 advisory. A patch was released in Webmin 2.641, addressing the vulnerability. Organizations running affected versions are urged to upgrade immediately and audit existing templates for suspicious scripts. Additional mitigations include restricting template modification permissions and deploying web application firewalls (WAFs) to block injection attempts. The incident underscores the high-risk nature of stored XSS vulnerabilities in administrative tools, particularly those managing Unix-based systems. As threat actors increasingly target management interfaces, secure coding practices and least-privilege access controls remain critical defenses.