Stored Cross-Site Scripting Vulnerability in Webmin Shorewall Modules
CVE-2026-124552

4.8MEDIUM

Key Information:

Vendor: Webmin
Status: Webmin
Vendor: CVE Published:; 8 November 2026

What is CVE-2026-124552?

Webmin 2.670 is affected by a stored cross-site scripting (XSS) vulnerability in its Shorewall and Shorewall6 modules. This flaw occurs due to a lack of proper escaping for table fields and COMMENT lines in the list.cgi script. Authenticated users with permissions to edit these tables can store harmful JavaScript via savecmt.cgi or through table entries. When other users, including those with root access, view the list page, the malicious code executes, potentially compromising user sessions and data integrity.