Webmin (<= 2.670) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/webmin--2.670/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 04:02:33 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWebmin: OS command injection in samba/save_euser.cgi (CVE-2026-125391)https://feed.craftedsignal.io/briefs/2026-11-webmin-cmd-injection/Tue, 10 Nov 2026 04:02:33 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-webmin-cmd-injection/Webmin versions up to 2.670 contain an OS command injection vulnerability in the samba/save_euser.cgi script, allowing authenticated users to execute arbitrary commands as root via the opts parameter.Webmin versions through 2.670 are vulnerable to OS command injection within the samba/save_euser.cgi script. The vulnerability stems from the insufficient validation of the opts parameter. Authenticated users with permissions to manage Samba users can inject shell metacharacters into the account option flags processed by create_user and modify_user functions, leading to command execution with root privileges.

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary commands on the underlying host operating system with root-level privileges.

Recommendation

  • Upgrade Webmin to a version beyond 2.670 once a vendor security patch is available.
  • Audit administrative access to the Webmin Samba module to restrict it to trusted administrative accounts.
  • Implement the suggested hunt lead to monitor for suspicious command execution originating from the Webmin process context.
]]>highadvisory