Webmin vulnerabilities
We track 13 vulnerabilities in Webmin products across 2 products. 13 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on November 11, 2026.
Latest Webmin vulnerabilities
- 7.5 High severity
webmin: Improper Neutralization of CRLF Sequences
Webmin through 2.670 contains a users file injection vulnerability in acl/cert_issue.cgi that allows authenticated Webmin users to inject lines by supplying unvalidated certificate DN fields containing newlines. Attackers can end a DN field with a backslash an
- 7.2 High severity
webmin: Improper Privilege Management
Webmin through 2.670 contains a privilege escalation vulnerability in acl/save_group.cgi that allows delegated administrators to grant unauthorized modules by submitting arbitrary module lists in the mod parameter. Attackers with Webmin Users module access can
- 7.2 High severity
webmin: Improper Neutralization of Special Elements used in an OS Command
Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter. Attackers can embed shell metacharacters in account option flags pas
- 8.8 High severity
usermin: Improper Limitation of a Pathname to a Restricted Directory
Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email attachments with ../ se
- 7.5 High severity
usermin: Improper Neutralization of Special Elements used in an OS Command
Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an externa
- 9.6 Critical severity
webmin: Improper Neutralization of Input During Web Page Generation
Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are vulnerable to this XSS vulnerability that could be used to execute attacker-controlled commands. This
- 8.1 High severity
Webmin: Authentication Bypass by Spoofing
The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. A remote attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.202.
- 9.4 Critical severity
Webmin: Path Traversal: '../filedir'
Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi.
- 8.5 High severity
Webmin: Improper Neutralization of Special Elements used in an OS Command
squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissio
- 7.1 High severity
Webmin: Improper Access Control
Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject
- 8.8 High severity
Webmin: Improper Neutralization of Special Elements used in an OS Command
Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Webmin. Authentication is required to exploit this vulnerability. The specific flaw exists withi
- 8.8 High severity
Webmin: Improper Handling of Insufficient Permissions or Privileges
Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003. If this vulnerability is exploited, a console session may be hijacked by an unauthorized user. As a result, data within a system may b
- 9.8 Critical severity
Webmin Command Injection Exploited
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.