CVE-2025-67738

HIGH

Webmin < 2.600 - Authenticated OS Command Injection via Squid Cache Manager

Title source: llm
STIX 2.1

Description

squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).

References (3)

Core 3

Scores

CVSS v3 8.5
EPSS 0.0031
EPSS Percentile 22.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (1)
Webmin/Webmin < 2.600
Published Dec 11, 2025
Tracked Since Feb 18, 2026