{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/webmin--2.670/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-125391"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Webmin (\u003c= 2.670)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Webmin"],"content_html":"\u003cp\u003eWebmin versions through 2.670 are vulnerable to OS command injection within the \u003ccode\u003esamba/save_euser.cgi\u003c/code\u003e script. The vulnerability stems from the insufficient validation of the \u003ccode\u003eopts\u003c/code\u003e parameter. Authenticated users with permissions to manage Samba users can inject shell metacharacters into the account option flags processed by \u003ccode\u003ecreate_user\u003c/code\u003e and \u003ccode\u003emodify_user\u003c/code\u003e functions, leading to command execution with root privileges.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker to execute arbitrary commands on the underlying host operating system with root-level privileges.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Webmin to a version beyond 2.670 once a vendor security patch is available.\u003c/li\u003e\n\u003cli\u003eAudit administrative access to the Webmin Samba module to restrict it to trusted administrative accounts.\u003c/li\u003e\n\u003cli\u003eImplement the suggested hunt lead to monitor for suspicious command execution originating from the Webmin process context.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T04:02:33Z","date_published":"2026-11-10T04:02:33Z","id":"https://feed.craftedsignal.io/briefs/2026-11-webmin-cmd-injection/","summary":"Webmin versions up to 2.670 contain an OS command injection vulnerability in the samba/save_euser.cgi script, allowing authenticated users to execute arbitrary commands as root via the opts parameter.","title":"Webmin: OS command injection in samba/save_euser.cgi (CVE-2026-125391)","url":"https://feed.craftedsignal.io/briefs/2026-11-webmin-cmd-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Webmin (\u003c= 2.670)","version":"https://jsonfeed.org/version/1.1"}