Webmin before version 2.641 contains a stored cross‑site scripting vulnerability in the email template description field of the System and Server Status module. Unsanitized input supplied by an authenticated user is persisted through save_tmpl.cgi and later rendered without escaping in list_tmpls.cgi, enabling the attacker to inject malicious code that can execute arbitrary commands on the host.

Any Webmin installation running a version older than 2.641 is affected. The vulnerability resides in the System and Server Status module’s email template description field and applies to all vendors’ Webmin packages.

The CVSS score of 5.1 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access with low privileges; once an attacker injects malicious content, it persists and can be executed when the template is rendered, posing a significant threat in environments where users have such access.