CVE-2025-67738: OS Command Injection
squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67738?
CVE-2025-67738 is considered a medium severity vulnerability due to its impact on unauthorized command execution risks if exploited.
How do I fix CVE-2025-67738?
To fix CVE-2025-67738, update Webmin to version 2.600 or later, which addresses the quoting issues in the Cache Manager.
Who is affected by CVE-2025-67738?
CVE-2025-67738 affects users of Webmin versions prior to 2.600 who have enabled the Squid module and its Cache Manager feature.
What type of vulnerability is CVE-2025-67738?
CVE-2025-67738 is a command injection vulnerability that arises from improper handling of arguments in the Cache Manager.
Can CVE-2025-67738 be exploited remotely?
Exploitation of CVE-2025-67738 requires that the attacker has authenticated access to Webmin with specific Cache Manager permissions.