Webmin before version 2.641 includes a stored cross‑site scripting vulnerability (CWE‑79) in the email template description field of the System and Server Status module. Unsanitized input supplied by a low‑privileged authenticated user is persisted through save_tmpl.cgi and later rendered without escaping in list_tmpls.cgi, enabling the attacker to inject malicious code that can execute arbitrary JavaScript in the browser context of administrators.

Any Webmin installation running a version older than 2.641 is affected. The vulnerability resides in the System and Server Status module’s email template description field and applies to all vendors’ Webmin packages.

The CVSS score of 5.1 indicates moderate severity. The EPSS score of <1% shows a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access with low privileges; once an attacker injects malicious content, it persists and can be executed when the template is rendered, posing a significant threat in environments where users have such access.