CVE-2026-49243

CRITICAL 9.6

Webmin: Reflected XSS in the Configuration module

CVSS Score

9.6

EPSS Score

0.3%

EPSS Percentile

20th

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are vulnerable to this XSS vulnerability that could be used to execute attacker-controlled commands. This issue has been patched in version 2.650.

CWE	CWE-79
Vendor	webmin
Product	webmin
Published	Sep 29, 2026
Last Updated	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for webmin webmin

Be the first to know when new critical vulnerabilities affecting webmin webmin are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

webmin / webmin

< 2.650

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/webmin/webmin/security/advisories/GHSA-hv4w-p8jq-2rp5 github.com: https://github.com/webmin/webmin/commit/2d016751399ed0f4159e72a6cbcd63694a84dabf beaksec.github.io: https://beaksec.github.io/posts/webmin-one-click-rce-via-xss github.com: https://github.com/webmin/webmin/releases/tag/2.650