PT-2025-50582 · Webmin+1 · Webmin+1

Filippo Decortes · Published 2025-12-11 · Updated 2026-04-01 · CVE-2025-67738

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Webmin versions prior to 2.600

Description The application does not properly handle arguments within the cachemgr.cgi script when the Squid module and its Cache Manager feature are enabled. This issue arises if an unauthorized user gains access to Webmin and possesses specific Cache Manager permissions, specifically the "cms" security option. The problem occurs when arguments are not correctly quoted, potentially leading to unintended consequences.

Recommendations Update to Webmin version 2.600 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-05707

CVE-2025-67738

Affected Products

Red Os

Webmin

References · 14

• https://osv.dev/vulnerability/CVE-2025-67738 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67738 · Security Note
• https://bdu.fstec.ru/vul/2026-05707 · Security Note
• https://github.com/webmin/webmin/compare/2.520...2.600 · Note
• https://github.com/webmin/webmin/commit/1a52bf4d72f9da6d79250c66e51f41c6f5b880ee · Note
• https://t.me/cveNotify/146191 · Telegram Post
• https://t.me/CVEtracker/39460 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-webmin-cve-2025-67738-7.3 · Note
• https://twitter.com/CVEnew/status/1999108868333502578 · Twitter Post
• https://webmin.com/security/#privilige-escalation-using-squid-module-cve-2025-67738 · Note
• https://t.me/cveNotify/145413 · Telegram Post
• https://redos.red-soft.ru/search/?iblock_id=24&q=CVE-2025-67738 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-webmin-cve-2025-67738-8.0 · Note
• https://twitter.com/CveFindCom/status/1999021092128673793 · Twitter Post