CVE-2022-30708
Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user...
Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter.
- Record
CVE-2022-30708- CVSS 3.1
- 8.8 High
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N - Updated
- 2026-11-02
EUVDEUVD-2022-52538
Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter.
- Record
EUVD-2022-52538- CVSS 3.1
- 8.8 High
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jgr2-cp5w-vm48
Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user...
Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter.
- Record
GHSA-jgr2-cp5w-vm48- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
NVD
Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter.
- Record
CVE-2022-30708- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Updated
- 2026-11-02
OSV
Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter.
- Record
CVE-2022-30708- CVSS 3.1
- 8.8 High
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N - Updated
- 2026-11-02
OSVMGASA-2022-0216 No score
Updated webmin packages fix security vulnerability
Less privileged Webmin users (excluding those created by Virtualmin and Cloudmin) can modify arbitrary files with root privileges, and so run commands as root (CVE-2022-30708).
- Record
MGASA-2022-0216- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
webminMageia:8 |
before 1.994-1.mga8 | 1.994-1.mga8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-30708 is a high vulnerability (CVSS 8.8) in Webmin, published May 15, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.83%, the 90th percentile. Fixed in webmin 1.994-1.mga8.
References
github.com/webmin/webmin/issues/1635
twitch.tv/videos/1483029790
webmin.com/changes.html
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2022-30708
advisories.mageia.org/MGASA-2022-0216.html
bugs.mageia.org/show_bug.cgi?id=30465
webmin.com/security.html