CVE-2025-67738

⚠️ high

Summary

squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).

CVSS Score

8.5

High

EPSS Score

0.4

Exploit Probability

Published Date

2025-12-11

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 80.2% of all 365,987 vulnerabilities in our database.

#72,501

Top 25% most severe

Severity Percentile

🎯 CISA SSVC Assessment Updated: Dec 11, 2025

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

SSVC data provided by CISA

Last Modified 2026-10-14

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-78

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
webmin	webmin	Affected	< 2.600

🔗 References 3

https://github.com/webmin/webmin/commit/1a52bf4d72f9...

https://github.com/webmin/webmin/compare/2.520...2.600

https://webmin.com/security/#privilige-escalation-us...

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-56021	🔶 medium	5.3	0.5	Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due ...	2026-06-18
CVE-2026-56022	🔶 medium	5.3	0.6	Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, a...	2026-06-18
CVE-2026-22678	🔶 medium	5.4	0.2	Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the ...	2026-05-21
CVE-2025-61541	⚠️ high	7.1	0.1	Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset l...	2025-10-16
CVE-2024-12828	⚠️ high	8.8	21.7	Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ...	2024-12-30
CVE-2024-45692	⚠️ high	7.5	0.1	Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000.	2024-09-04

These CVEs affect the same products