Webmin

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Webmin product.

RSS Feeds for Webmin security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Webmin products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Webmin Sorted by Most Security Vulnerabilities since 2018

Webmin60 vulnerabilities

Webmin Usermin15 vulnerabilities

Known Exploited Webmin Vulnerabilities

The following Webmin vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Webmin Command Injection Vulnerability	An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability. CVE-2019-15107 Exploit Probability: 99.8%	March 25, 2022

The vulnerability CVE-2019-15107: Webmin Command Injection Vulnerability is in the top 1% of the currently known exploitable vulnerabilities.

By the Year

In 2026 there have been 7 vulnerabilities in Webmin with an average score of 6.0 out of ten. Last year, in 2025 Webmin had 3 security vulnerabilities published. That is, 4 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 2.09

Year	Vulnerabilities	Average Score
2026	7	6.04
2025	3	8.13
2024	8	6.63
2023	27	5.56
2022	14	7.91
2021	3	9.07
2020	4	8.80
2019	6	7.63
2018	1	9.80

It may take a day or so for new Webmin vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Webmin Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-42210	Jul 20, 2026	Webmin 2FA Bypass via Basic Auth before 2.640 Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor (typically TOTP), an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication. Webmin is a web-based system administration tool for Unix-like servers. As a workaround, apply the patch from commit da18a16c84ae5c0b78cad79609cb0efb174000ec manually.	Webmin
CVE-2026-56020	Jun 18, 2026	Webmin miniserv.pl DN Spoofing: Unauth Impersonation pre2.641 The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. A remote attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.202.	Webmin
CVE-2026-56021	Jun 18, 2026	CVE-2026-56021: Unauth File Read via .conf Bypass in Webmin Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.	Webmin
CVE-2026-56022	Jun 18, 2026	Webmin Bypass Basic Auth via UA Header (<=2.640) Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.	Webmin
CVE-2026-49103	May 27, 2026	Webmin < 2.640 - insecure filename construction in mailboxes/detachall.cgi Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi.	Webmin
CVE-2026-49102	May 27, 2026	Webmin XSS via SVG attachment in mailboxes (before 2.640) Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes component, because image/svg+xml is used instead of a safe type (e.g., text/plain).	Webmin
CVE-2026-22678	May 21, 2026	Webmin <2.641 Stored XSS in Email Template Description (System & Server Status) Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privileged authenticated attackers to execute arbitrary JavaScript in the browser context of administrators by injecting unsanitized input stored in save_tmpl.cgi and rendered unescaped in list_tmpls.cgi.	Webmin
CVE-2025-67738	Dec 11, 2025	Unquoted Arg in Webmin Squid cachemgr.cgi (pre2.600) squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).	Webmin
CVE-2025-61541	Oct 16, 2025	Webmin 2.5.10 Host Header Injection in Password Reset Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.	Webmin
CVE-2015-2079	Apr 28, 2025	Usermin <1.660 Remote Code Execution via uconfig_save.cgi (sig_file_free) Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open.	Usermin