CVE-2026-59680

Name of the Vulnerable Software and Affected Versions yast2-users versions prior to 5.0.9

Description An OS command injection issue exists when displaying the Password Settings tab of a user. The get password term() function in src/include/users/dialogs.rb retrieves the shadowLastChange and shadowExpire fields using GetString(), which lacks numeric validation. These strings are then passed to the format days after epoch() helper, which interpolates the values into a shell command executed via Ruby backticks without proper quoting or escaping. This allows an administrator managing users via an external or federated LDAP directory to trigger root command execution simply by viewing or editing a user entry.

Recommendations Update yast2-users to version 5.0.9 or later.