PT-2026-141214

CVE-2026-125391

·

Published

2026-11-09

·

Updated

2026-11-10

Description by

CVSS 3.1
7.2
High
MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Webmin through 2.670 contains an OS command injection vulnerability in samba/save euser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter. Attackers can embed shell metacharacters in account option flags passed by create user and modify user to backquote logged, executing commands as root.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')
Related identifiers
CVE-2026-125391
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com