CVE-2026-49243: Webmin XSS Vulnerability

CVE-2026-49243 Overview

CVE-2026-49243 is a reflected cross-site scripting (XSS) vulnerability in Webmin, a web-based system administration tool for Unix-like servers. Versions prior to 2.650 fail to fully sanitize HTML5 event handler attributes in status messages processed by the filter_javascript function. An attacker can craft a malicious link that, when clicked by an authenticated Webmin user, executes attacker-controlled JavaScript in the victim's browser session. Because Webmin runs with administrative privileges, successful exploitation can allow the attacker to trigger arbitrary administrative commands within the victim's session. The issue is tracked under [CWE-79] and was patched in Webmin release 2.650.

Critical Impact
Successful exploitation permits execution of attacker-controlled JavaScript within an authenticated Webmin session, potentially leading to unauthorized administrative actions on the managed server.

Affected Products

Webmin versions prior to 2.650
Webmin deployments on Unix-like servers exposing the administrative web interface
Any environment where administrators may be induced to click untrusted links while logged into Webmin

Discovery Timeline

2026-09-29 - CVE-2026-49243 published to NVD
2026-09-29 - Last updated in NVD database
Webmin 2.650 - Vendor releases patched version addressing the flaw

Technical Details for CVE-2026-49243

Vulnerability Analysis

The vulnerability resides in Webmin's filter_javascript helper inside web-lib-funcs.pl. The routine attempts to neutralize inline JavaScript by prefixing dangerous event handler attributes with an x character. The original allow-list only covered a fixed set of legacy event handlers such as onClick, onLoad, and onMouseOver. Modern HTML5 event handlers, including onwheel, onpointerdown, and onloadstart, were not stripped. In addition, the fallback regular expression did not account for slash-separated attribute syntax like <video/onloadstart=alert(1) src=1>, allowing bypasses of the sanitizer.

Because Webmin reflects status messages back to the user without further encoding, an attacker-crafted URL that reaches the status message rendering path results in reflected XSS in the administrator's authenticated context.

Root Cause

The root cause is incomplete input sanitization in an HTML filter that relied on an enumerated list of event handler names and a permissive attribute regex. Any HTML5 event handler introduced after the list was written, and any syntactic variation using / as an attribute separator, evaded neutralization and reached the DOM intact.

Attack Vector

Exploitation requires user interaction: an authenticated Webmin user must click a crafted link that causes a payload to be echoed into a status message. No credentials are required from the attacker to construct the link, but the victim must have an active Webmin session for the JavaScript to run in a privileged context.

text

// Patch excerpt from web-lib-funcs.pl (Webmin 2.650)
// Replaces the static event-handler allow-list with a generic regex
// that matches any on* attribute, including slash-separated forms.

-	$rv =~ s/(on(Abort|BeforeUnload|Blur|Change|Click|...|Unload)=)/x$1/gi;
-	$rv =~ s/<([^>]*\s|)(on\S+=)(.*)>/<$1x$2$3>/gi;
+	my $event_attr = qr/on[a-z][a-z0-9_:-]*\s*=/i;
+	my $event_attrs;
+	do {
+		$event_attrs = 0;
+		$event_attrs += $rv =~ s{(<[^>]*?)([\s/]+)($event_attr)}{$1$2x$3}g;
+		$event_attrs += $rv =~ s{(<)($event_attr)}{$1x$2}g;
+	} while ($event_attrs);

Source: Webmin commit 2d016751

Detection Methods for CVE-2026-49243

Indicators of Compromise

Webmin access logs containing request parameters with HTML tags and event handler attributes such as onloadstart=, onpointerdown=, or onwheel=.
Requests where payloads use slash-separated syntax, for example <video/onloadstart=...> or <img/onerror=...>.
Referrer headers pointing to external sites immediately followed by administrative actions in the same Webmin session.

Detection Strategies

Inspect Webmin request URIs and POST bodies for HTML fragments containing on*= event handlers reflected into status messages.
Alert on outbound HTTP requests originating from browsers immediately after an administrator interacts with Webmin, which may indicate exfiltration by injected JavaScript.
Correlate administrator session activity with unusual command execution or user creation events performed shortly after clicking an external link.

Monitoring Recommendations

Enable and centrally collect Webmin miniserv access logs and forward them to a SIEM for pattern matching on XSS payload signatures.
Monitor Webmin configuration and account changes to detect unauthorized administrative actions performed through a hijacked session.
Track version strings reported by Webmin instances to confirm all deployments are running 2.650 or later.

How to Mitigate CVE-2026-49243

Immediate Actions Required

Upgrade all Webmin installations to version 2.650 or later, which contains the corrected filter_javascript implementation.
Restrict network access to the Webmin administrative interface using firewall rules or VPN so it is not reachable from untrusted networks.
Instruct Webmin administrators not to click on links to their Webmin server received from untrusted sources while authenticated.

Patch Information

The fix is included in Webmin Release 2.650. The corresponding source change replaces the static event-handler list with a generic regex loop that neutralizes any on* attribute, including slash-separated forms. See the GitHub Security Advisory GHSA-hv4w-p8jq-2rp5 for coordinated disclosure details and the upstream commit for the exact code change.

Workarounds

Bind Webmin to a management-only interface and require VPN access to reduce the reflected XSS attack surface.
Deploy a reverse proxy or web application firewall in front of Webmin with rules that block requests containing on[a-z]+= patterns inside HTML tags.
Enforce short Webmin session timeouts and require re-authentication for privileged operations to limit the window in which a hijacked session is useful.

bash

# Confirm the running Webmin version and upgrade where required
rpm -q webmin || dpkg -s webmin | grep -i version

# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade webmin

# RHEL/CentOS/Fedora
sudo yum update webmin

# Verify the installed version is 2.650 or later
grep '^Version' /etc/webmin/version || cat /etc/webmin/version