CVE-2026-125391
HIGH
NVD
CVSS Score
7.2
Severity
HIGH
Published
Nov 10, 2026
Vendor
unknown
Description
Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter. Attackers can embed shell metacharacters in account option flags passed by create_user and modify_user to backquote_logged, executing commands as root.