The vulnerability is a stored cross‑site scripting flaw in the bind8/edit_recs.cgi script. DNS record values entered by users are output directly in the ALL view mode without HTML escaping, allowing an attacker to embed malicious JavaScript that will run in any administrator’s browser that views the zone records. Because the script runs with the administrator’s credentials in the browser, it can be used to hijack sessions, steal configuration data, or perform unauthorized actions that appear to originate from the administrator.

Webmin versions prior to 2.671, specifically Webmin 2.670 and earlier, where the bind8 module is installed. The vulnerability is exploitable by users who have permission to modify DNS zone records, such as delegated zone administrators in Virtualmin or other Webmin installations that delegate zone control.

The CVSS score of 5.1 indicates a medium severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to have delegated zone editing privileges and to inject JavaScript into a DNS record. Once a malicious record is stored, any administrator who views the zone in ALL mode will have the script executed in their browser. The attack vector is therefore authenticated but not privileged beyond the standard zone‑write permissions; it does not require remote code execution on the server itself, only client‑side script execution in the administrator’s session.