CVE-2025-67738

Published: Dec 11, 2025Modified: Dec 18, 2025

8.5

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 6.0

Source: MITRE (Secondary)

Description

squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (3)

https://github.com/webmin/webmin/commit/1a52bf4d72f9da6d79250c66e51f41c6f5b880ee

Source: cve@mitre.org

https://github.com/webmin/webmin/compare/2.520...2.600

Source: cve@mitre.org

https://webmin.com/security/#privilige-escalation-using-squid-module-cve-2025-67738

Source: cve@mitre.org

Timeline

No history available yet.