CVE-2026-125391: falha de alta gravidade em webmin
Webmin through 2.670 OS Command Injection via Samba User Account Options
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
18Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.6
Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter. Attackers can embed shell metacharacters in account option flags passed by create_user and modify_user to backquote_logged, executing commands as root.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
webmin · webminCVEs relacionadas — webmin
No mesmo produto, das mais perigosas para as menos.
CVE-2026-42210MEDIUMWebmin 2FA requirement bypassEPSS 0.5%CVE-2026-102337MEDIUMWebmin: SSRF exploit in Upload and Download and File Manager modulesEPSS 0.5%CVE-2026-49243CRITICALWebmin: Reflected XSS in the Configuration moduleEPSS 0.3%CVE-2026-124552MEDIUMWebmin through 2.670 Stored XSS via Shorewall and Shorewall6 list.cgiEPSS 0.2%CVE-2026-125392MEDIUMWebmin through 2.670 Stored XSS via BIND8 edit_recs.cgi ALL ViewEPSS —