CVE-2026-125391: Webmin through 2.670 OS Command Injection via Samba User Account Options
Webmin through 2.670 contains an OS command injection vulnerability in samba/saveeuser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter. Attackers can embed shell metacharacters in account option flags passed by createuser and modifyuser to backquotelogged, executing commands as root.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be authenticated and have Samba user maintainer privileges in Webmin. Exploitation occurs through Samba account-management operations that invoke create_user or modify_user.
What input is used to trigger command execution?
The vulnerable input is the unvalidated opts parameter containing account option flags. An attacker can place shell metacharacters in those flags so they reach backquote_logged and execute commands as root.
What is the impact if exploitation succeeds?
Successful exploitation executes attacker-controlled operating-system commands as root. This can compromise confidentiality, integrity, and availability of the affected host.
Which versions are affected?
The available information identifies Webmin through version 2.670 as affected.