Description
Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter. Attackers can embed shell metacharacters in account option flags passed by create_user and modify_user to backquote_logged, executing commands as root.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| webmin | webmin | ≤ 2.670 | — |
Advisories 1
- WID-SEC-2026-4423 Webmin: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
References
- Patch Commit patch
- https://github.com/webmin/webmin product
- https://github.com/webmin/webmin/blob/2.670/samba/samba-lib.pl#L658 technical-description
- VulnCheck Advisory: Webmin through 2.670 OS Command Injection via Samba User Account Options third-party-advisory