Webmin: User file injection via acl/cert_issue.cgi (CVE-2026-126781)
Webmin through 2.670 contains a users file injection vulnerability in acl/cert_issue.cgi that allows authenticated Webmin users to inject lines by supplying unvalidated certificate DN fields containing newlines.
CVE search metadata
CVE search record: CVE-2026-126781. Severity: high. CVSS: 7.5. KEV: no. Product: Webmin. Brief: Webmin: User file injection via acl/cert_issue.cgi (CVE-2026-126781). Brief link: https://feed.craftedsignal.io/briefs/2026-11-webmin-file-injection-cve-2026-126781/
Triage facts
Revision 1- Applicability
- Webmin
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 20:05 UTC
- Detection
- 1 rule
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Webmin through 2.670 contains a users file injection vulnerability in acl/cert_issue.cgi. Authenticated users can inject lines by supplying unvalidated certificate DN fields containing newlines. Attackers can end a DN field with a backslash and newline to add a second root entry with a known password hash, gaining Webmin root access after miniserv restarts.
Impact
Successful exploitation allows an authenticated user to gain Webmin root access.
Recommendation
Refer to the vendor advisory for patching information.
Detection coverage 1
Detect Webmin acl/cert_issue.cgi Exploitation Attempt
highDetects potential exploitation by monitoring HTTP requests to the vulnerable cert_issue.cgi script with newline or backslash characters in parameters.
Detection queries are available on the platform. Get full rules →