CVE-2012-2982
Webmin <1.590 - Command Injection
Title source: llmDescription
file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as demonstrated by a | (pipe) character.
Exploits (19)
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremoteunix
https://www.exploit-db.com/exploits/21851
metasploit
WORKING POC
EXCELLENT
by Unknown, juan vazquez · rubypocunix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/webmin_show_cgi_exec.rb
References (6)
Scores
EPSS
0.8311
EPSS Percentile
99.2%
Classification
Status
draft
Affected Products (39)
gentoo/webmin
< 1.590
gentoo/webmin
gentoo/webmin
gentoo/webmin
gentoo/webmin
gentoo/webmin
gentoo/webmin
gentoo/webmin
gentoo/webmin
gentoo/webmin
gentoo/webmin
gentoo/webmin
gentoo/webmin
gentoo/webmin
gentoo/webmin
... and 24 more
Timeline
Published
Sep 11, 2012
Tracked Since
Feb 18, 2026