CVE-2026-125391

Description

Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter. Attackers can embed shell metacharacters in account option flags passed by create_user and modify_user to backquote_logged, executing commands as root.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/webmin/webmin/commit/18cab89b1fc74ab7e8b1b8b90bbccbe5aba99154 ↗
• https://github.com/webmin/webmin ↗
• https://github.com/webmin/webmin/blob/2.670/samba/samba-lib.pl#L658 ↗
• https://www.vulncheck.com/advisories/webmin-through-2.670-os-command-injection-via-samba-user-account-options ↗