software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.

published 2022-07-25 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-39156

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 95.9%; EPSS 95.9% chance of exploitation in 30 days, percentile 99.8%
public exploits: 2; Metasploit, Exploit-DB, plus a Nuclei check

Patch / fix

fixed in 1 links 1

webmin webmin 1.997

github.com/webmin/webmin@13f7bf9 commit

Timeline

2022-07-25 Published
2022-07-26 First public exploit (Metasploit exploit/linux/http/webmin_package_updates_rce)

Exploit prediction

95.95% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/linux/http/webmin_package_updates_rce Webmin Package Updates RCE metasploit exploit, excellent rank, 2022-07-26
EDB-50998 Webmin 1.996 - Remote Code Execution (RCE) (Authenticated) webapps, 2022-08-01
Nuclei template Webmin <1.997 - Authenticated Remote Code Execution nuclei detection template
gist.github.com https://gist.github.com/emirpolatt/cf19d6c0128fa3e25ebb47e09243919b referenced PoC, tagged "exploit" by a source, unverified
packetstormsecurity.com http://packetstormsecurity.com/files/168049/Webmin-Package-Updates-Command-Injection.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness

CWE-116 Improper Encoding or Escaping of Output

References

github.com /webmin/webmin/commit/13f7bf9621a82d93f1e9dbd838d1e22020221bde
patch, third-party-advisory
gist.github.com /emirpolatt/cf19d6c0128fa3e25ebb47e09243919b
exploit, third-party-advisory
packetstormsecurity.com /files/168049/Webmin-Package-Updates-Command-Injection.html
exploit, third-party-advisory, vdb-entry
github.com /webmin/webmin/compare/1.996...1.997
release-notes, third-party-advisory
packetstormsecurity.com /files/167894/Webmin-1.996-Remote-Code-Execution.html
third-party-advisory, vdb-entry
exploit-db.com /exploits/50998
third-party-advisory, vdb-entry

Sources

CVE List CVE-2022-36446
NVD CVE-2022-36446

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary