HIGH 8.6 NVD
CVE-2026-125391
Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject commands
Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter. Attackers can embed shell metacharacters in account option flags passed by create_user and modify_user to backquote_logged, executing commands as root.
References
- https://github.com/webmin/webmin
- https://github.com/webmin/webmin/blob/2.670/samba/samba-lib.pl#L658
- https://github.com/webmin/webmin/commit/18cab89b1fc74ab7e8b1b8b90bbccbe5aba99154
- https://www.vulncheck.com/advisories/webmin-through-2.670-os-command-injection-via-samba-u
This high severity vulnerability with a CVSS score of 8.6 was published on 2026-11-10 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.