CVE-2026-126781

Description

Webmin through 2.670 contains a users file injection vulnerability in acl/cert_issue.cgi that allows authenticated Webmin users to inject lines by supplying unvalidated certificate DN fields containing newlines. Attackers can end a DN field with a backslash and newline to add a second root entry with a known password hash, gaining Webmin root access after miniserv restarts.

References

• https://github.com/webmin/webmin/blob/2.670/acl/cert_issue.cgi#L22-L52
• https://github.com/webmin/webmin/commit/0c449e341746d8c445c8c7db223eac1f41755943
• https://github.com/webmin/webmin/commit/8fb194e5fbc30a6664545d48940d03759ace9bf2
• https://www.vulncheck.com/advisories/webmin-through-2.670-users-file-injection-via-acl-cert-issue-cgi