High severity7.5NVD Advisory· Published Nov 11, 2026· Updated Nov 11, 2026
CVE-2026-126781
CVE-2026-126781
Description
Webmin through 2.670 contains a users file injection vulnerability in acl/cert_issue.cgi that allows authenticated Webmin users to inject lines by supplying unvalidated certificate DN fields containing newlines. Attackers can end a DN field with a backslash and newline to add a second root entry with a known password hash, gaining Webmin root access after miniserv restarts.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
4- github.com/webmin/webmin/blob/2.670/acl/cert_issue.cginvd
- github.com/webmin/webmin/commit/0c449e341746d8c445c8c7db223eac1f41755943nvd
- github.com/webmin/webmin/commit/8fb194e5fbc30a6664545d48940d03759ace9bf2nvd
- www.vulncheck.com/advisories/webmin-through-2.670-users-file-injection-via-acl-cert-issue-cginvd
News mentions
0No linked articles in our index yet.