CVE-2026-22678 — The Email Template Description Field Of The System And Serve Cross-Site Scripting (XSS)

title: Stored XSS in Webmin Email Template Description - CVE-2026-22678
id: scw-2026-05-21-ai-1
status: experimental
level: high
description: |
  Detects the specific stored XSS vulnerability in Webmin's email template description field (CVE-2026-22678). Attackers inject malicious JavaScript via the 'desc' parameter in save_tmpl.cgi, which is later rendered unescaped in list_tmpls.cgi. This rule looks for the save_tmpl.cgi endpoint with a 'desc' parameter containing potential XSS payloads.
author: SCW Feed Engine (AI-generated)
date: 2026-05-21
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-22678/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/save_tmpl.cgi'
      cs-uri-query|contains:
          - 'desc='
      sc-status:
          - 200
  selection_payload:
      cs-uri-query|contains:
          - '<script>alert(' # Example of a common XSS payload start
          - '&#x3c;script&#x3e;' # HTML encoded script tag
          - 'javascript:' # Common in attribute injection
      condition: selection AND selection_payload
  
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse