{"id":"CVE-2026-125391","kind":"vulnerability","aliases":["CVE-2026-125391"],"related":[],"title":"Webmin: Samba user maintainers can run commands as root","description":"Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter. Attackers can embed shell metacharacters in account option flags passed by create_user and modify_user to backquote_logged, executing commands as root.","summary":"Webmin through 2.670 passes unvalidated opts values from samba/save_euser.cgi into a shell command, so shell metacharacters in account option flags run on the host. An authenticated Samba user maintainer can execute commands as root.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"webmin","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["linux","runtime","samba","self-hosted","webmin"],"not_affected_if":["no-samba-maintainers","no-webmin","samba-module-disabled"],"how_to_check":"- Check the installed Webmin version against the product ranges in the NVD entry (`webmin --version` or the version shown in the Webmin dashboard)\n- Look for the Samba module (samba/save_euser.cgi) being enabled and used for user maintenance","fix":"- Webmin: a patched version is linked from the patch reference, but the sources do not state the fixed version number","status":"open","published_at":"2026-11-10T00:17:12+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","triaged_at":"2026-11-10T00:29:47+00:00","updated_at":"2026-11-10T00:29:47+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-10T00:29:47Z","model":"claude-haiku-5-5","output":{"fix":"- Webmin: a patched version is linked from the patch reference, but the sources do not state the fixed version number","reach":"network","title":"Webmin: Samba user maintainers can run commands as root","impact":"high","summary":"Webmin through 2.670 passes unvalidated opts values from samba/save_euser.cgi into a shell command, so shell metacharacters in account option flags run on the host. An authenticated Samba user maintainer can execute commands as root.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["webmin","self-hosted","samba","linux"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Commands run as root on the server.","analyst_note":"Confirm the fixed Webmin version from the GitHub patch reference and the vulncheck advisory; the sources do not name it.","how_to_check":"- Check the installed Webmin version against the product ranges in the NVD entry (`webmin --version` or the version shown in the Webmin dashboard)\n- Look for the Samba module (samba/save_euser.cgi) being enabled and used for user maintenance\n- unknown whether the sources list any other check","plain_action":"","product_name":"webmin","needs_analyst":true,"not_affected_if":["no-webmin","samba-module-disabled","no-samba-maintainers"],"who_is_affected":"Hosts running Webmin up to and including 2.670 with the Samba module in use, where some accounts are allowed to maintain Samba users. Servers without Webmin, or without the Samba module, are not exposed by this flaw. Anyone who only uses Webmin with administrators who already hold root is at lower risk, but the flaw still lets a maintainer escalate to root.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000782,"input_tokens":4600,"output_tokens":643,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125391':12A,15A '-2026':11A,14A '2.670':26B,60C 'account':41B,88C 'allow':70C 'attack':82C 'authent':49B,71C 'backquot':99C 'command':7A,36B,55B,64C,77C,102C 'contain':61C 'creat':93C 'cve':10A,13A 'emb':84C 'execut':54B,101C 'flag':43B,90C 'host':22B,47B 'inject':65C,76C 'linux':17B 'log':100C 'maintain':4A,52B,74C 'metacharact':39B,86C 'modifi':96C 'opt':29B,80C 'option':42B,89C 'os':63C 'paramet':81C 'pass':27B,91C 'root':9A,57B,104C 'run':6A,44B 'runtim':18B 'samba':2A,19B,50B,72C 'samba/save_euser.cgi':32B,68C 'self':21B 'self-host':20B 'shell':35B,38B,85C 'unvalid':28B,79C 'user':3A,51B,73C,94C,97C 'valu':30B 'via':78C 'vulner':66C 'webmin':1A,16A,23B,24B,58C","nicknames":[],"mitigations":[],"who_affected":"Hosts running Webmin up to and including 2.670 with the Samba module in use, where some accounts are allowed to maintain Samba users. Servers without Webmin, or without the Samba module, are not exposed by this flaw. Anyone who only uses Webmin with administrators who already hold root is at lower risk, but the flaw still lets a maintainer escalate to root.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["webmin"],"ptokens":["webmin"],"labels":["high","linux","runtime","samba","selfhosted","vendor","webmin"],"campaign_type":null,"search_a":"'-125391':12A,15A '-2026':11A,14A 'command':7A 'cve':10A,13A 'maintain':4A 'root':9A 'run':6A 'samba':2A 'user':3A 'webmin':1A,16A","search_b":"'2.670':26B 'account':41B 'authent':49B 'command':36B,55B 'execut':54B 'flag':43B 'host':22B,47B 'linux':17B 'maintain':52B 'metacharact':39B 'opt':29B 'option':42B 'pass':27B 'root':57B 'run':44B 'runtim':18B 'samba':19B,50B 'samba/save_euser.cgi':32B 'self':21B 'self-host':20B 'shell':35B,38B 'unvalid':28B 'user':51B 'valu':30B 'webmin':23B,24B","search_c":"'2.670':60C 'account':88C 'allow':70C 'attack':82C 'authent':71C 'backquot':99C 'command':64C,77C,102C 'contain':61C 'creat':93C 'emb':84C 'execut':101C 'flag':90C 'inject':65C,76C 'log':100C 'maintain':74C 'metacharact':86C 'modifi':96C 'opt':80C 'option':89C 'os':63C 'paramet':81C 'pass':91C 'root':104C 'samba':72C 'samba/save_euser.cgi':68C 'shell':85C 'unvalid':79C 'user':73C,94C,97C 'via':78C 'vulner':66C 'webmin':58C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125391","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125391","severity":null,"published_at":"2026-11-10T00:17:12+00:00","modified_at":"2026-11-10T00:17:12+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","fetched_at":"2026-11-10T00:28:44+00:00","note":null}],"documents":[{"id":111579,"url":"https://github.com/webmin/webmin/commit/18cab89b1fc74ab7e8b1b8b90bbccbe5aba99154","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111580,"url":"https://www.vulncheck.com/advisories/webmin-through-2.670-os-command-injection-via-samba-user-account-options","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}