Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-125391: Webmin lets authenticated users run commands as root

CVE-2026-125391 · published 4 days ago

Summary

Webmin versions up to 2.670 let a user who can manage Samba accounts add special characters to account settings, causing the system to run unwanted commands with full administrator rights. This could let an insider or compromised account take control of the server. Upgrade Webmin to a newer release or apply the vendor's fix and restrict Samba account management to trusted personnel.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
webmin	webmin	<= 2.670

Original advisory text

Webmin through 2.670 OS Command Injection via Samba User Account Options

Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter. Attackers can embed shell metacharacters in account option flags passed by create_user and modify_user to backquote_logged, executing commands as root.

References

https://github.com/webmin/webmin/commit/18cab89b1fc74ab7e8b1b8b90bbccbe5aba99154 Patch
https://github.com/webmin/webmin Product
https://github.com/webmin/webmin/blob/2.670/samba/samba-lib.pl#L658 Third Party Advisory
https://www.vulncheck.com/advisories/webmin-through-2.670-os-command-injection-v... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-1253... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-125391 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.4 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-78OS Command Injection

Timeline

Published9 Nov 2026

Updated13 Nov 2026

First seen10 Nov 2026

Sources

CVE-2026-125391 · NVD

CVE-2026-125391 · MITRE

CVE-2026-125391 · OSV

Track software like this

Free during beta