# CVE-2026-126781: Webmin users file injection in cert_issue.cgi

Source: https://junglewise.ai/threats/cve-2026-126781-webmin-through-2-670-contains-a-users-file-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-126781 · Severity: high · CVSS 7.5 · Published 2026-11-11

Webmin is a web-based system administration tool that allows authenticated users to manage server settings and accounts. A vulnerability in the certificate issuance functionality allows authenticated administrators to inject arbitrary lines into the Webmin users database by embedding newline characters in certificate fields, potentially creating a rogue administrator account with a known password hash.

Technologies: [Webmin](https://junglewise.ai/threats/technologies/webmin). Vendors: [Webmin](https://junglewise.ai/threats/vendors/webmin).

## Quick answers

**Is CVE-2026-126781 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126781 being exploited in the wild.

**How severe is CVE-2026-126781?** High severity, with a CVSS score of 7.5, published 11 November 2026.

**Which products and versions are affected?** Webmin through 2.670.

**Is there a fix for CVE-2026-126781?** Yes: fixed in Webmin 2.671 and later (based on commit 0c449e3). Until then: Restrict access to the certificate issuance functionality in acl/cert_issue.cgi to trusted administrators only, or disable certificate issuance until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126781 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-126781?** Check whether you run Webmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Webmin 2.671 and later (based on commit 0c449e3)

Restrict access to the certificate issuance functionality in acl/cert_issue.cgi to trusted administrators only, or disable certificate issuance until upgrading.

## Technical details

The acl/cert_issue.cgi script in Webmin through 2.670 fails to validate certificate Distinguished Name (DN) fields for newline characters before writing them to a configuration file. An authenticated attacker can inject newlines and backslash characters in fields such as commonName or organizationName to add malicious lines to the users file. Upon miniserv restart, these injected lines are parsed, allowing the attacker to create a new root account and escalate privileges.

## Affected products

- Webmin Webmin through 2.670

## Timeline

- 2026-11-11: disclosed

## References

- [https://github.com/webmin/webmin/blob/2.670/acl/cert_issue.cgi](https://github.com/webmin/webmin/blob/2.670/acl/cert_issue.cgi)
- [https://github.com/webmin/webmin/commit/0c449e341746d8c445c8c7db223eac1f41755943](https://github.com/webmin/webmin/commit/0c449e341746d8c445c8c7db223eac1f41755943)

## Related threats

- [Webmin privilege escalation in ACL group module assignment](https://junglewise.ai/threats/cve-2026-126780-webmin-through-2-670-contains-a-privilege-escalation)
- [Webmin stored cross-site scripting in bind8 DNS records](https://junglewise.ai/threats/cve-2026-125392-webmin-through-2-670-contains-a-stored-cross-site-scripting)
- [Webmin OS command injection in samba/save_euser.cgi](https://junglewise.ai/threats/cve-2026-125391-webmin-through-2-670-contains-an-os-command-injection)
- [Webmin stored cross-site scripting in Shorewall modules](https://junglewise.ai/threats/cve-2026-124552-webmin-through-2-670-contains-a-stored-cross-site-scripting)
- [Webmin SSRF in URL download functionality](https://junglewise.ai/threats/cve-2026-102337-webmin-is-a-web-based-system-administration-tool-for-unix-like)