Webmin: OS command injection in samba/save_euser.cgi (CVE-2026-125391)
Webmin versions up to 2.670 contain an OS command injection vulnerability in the samba/save_euser.cgi script, allowing authenticated users to execute arbitrary commands as root via the opts parameter.
CVE search metadata
CVE search record: CVE-2026-125391. Severity: high. CVSS: 7.2. KEV: no. Product: Webmin (<= 2.670). Brief: Webmin: OS command injection in samba/save_euser.cgi (CVE-2026-125391). Brief link: https://feed.craftedsignal.io/briefs/2026-11-webmin-cmd-injection/
Triage facts
Revision 1- Applicability
- Webmin (<= 2.670)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 10, 04:02 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Webmin versions through 2.670 are vulnerable to OS command injection within the samba/save_euser.cgi script. The vulnerability stems from the insufficient validation of the opts parameter. Authenticated users with permissions to manage Samba users can inject shell metacharacters into the account option flags processed by create_user and modify_user functions, leading to command execution with root privileges.
Impact
Successful exploitation allows an authenticated attacker to execute arbitrary commands on the underlying host operating system with root-level privileges.
Recommendation
- Upgrade Webmin to a version beyond 2.670 once a vendor security patch is available.
- Audit administrative access to the Webmin Samba module to restrict it to trusted administrative accounts.
- Implement the suggested hunt lead to monitor for suspicious command execution originating from the Webmin process context.
Threat Hunt
Identify unexpected child processes spawned by the Webmin web server process
Data: Process creation logs (Sysmon Event ID 1 or Auditd logs)
Mitigations
Upgrade Webmin to the version following 2.670
CVE-2026-125391