The flaw is a reflected XSS in Webmin's configuration module that allows an attacker to inject malicious code. By crafting a specially crafted link and having a user click on it, the attacker can have the browser execute script that may lead to arbitrary command execution on the server as the Webmin user, exposing the system to full compromise.

All installations of Webmin versions older than 2.650 are vulnerable. The issue was reported for users who click on a malicious link to their server and was patched in release 2.650.

The CVSS score of 9.6 indicates critical severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the vulnerability via a malicious link, requiring the victim to interact with the referrer page; no network or privileged conditions are required.