This flaw arises from unescaped table fields and COMMENT lines in the Shorewall and Shorewall6 modules’ list.cgi scripts in Webmin versions up to 2.670. An attacker who can edit table entries or the savecmt.cgi endpoint can store arbitrary JavaScript. When another user, such as root, views the affected list page, the injected script runs in that user’s browser session, potentially allowing the attacker to steal session tokens, deface content, or perform actions on behalf of the victim.

All installations of Webmin up to and including version 2.670 that enable the Shorewall or Shorewall6 modules. The vulnerability is tied specifically to the list.cgi handlers in these modules; products without these modules or newer Webmin releases are not affected.

The CVSS score of 4.8 indicates moderate severity. Because the entry requires authentication and a table‑edit privilege, the attacker must first obtain valid credentials or convince an authorized user to perform the action. The EPSS score is not available and the vulnerability is not currently listed in CISA’s KEV catalog. If an attacker gains sufficient access, the injected script can compromise the look‑and‑feel of the web interface for all users who view the page, but does not directly grant code execution on the host or privilege escalation. The likely attack vector is a compromised or social‑engineering‑pwned authenticated session used to create or edit table entries.