# CVE-2026-125391

Authenticated OS command injection in Webmin samba user options allowing root command execution.

- Page: https://www.vulneraibility.com/cve/CVE-2026-125391
- CVSS: 8.6
- Known exploited: not in CISA KEV as of our last sync
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-11-10)
- Weakness: CWE-78
- Published: 2026-11-09

## Affected versions

- webmin: affected <= 2.670

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated Samba user maintainer can inject shell metacharacters via opts to execute arbitrary commands as root on the Webmin host.

## Action

Immediate action required

## Recommendation

Apply the vendor patch/update immediately; restrict Webmin access and audit affected accounts.

## References

- [patch] https://github.com/webmin/webmin/commit/18cab89b1fc74ab7e8b1b8b90bbccbe5aba99154
- [other] https://github.com/webmin/webmin
- [other] https://github.com/webmin/webmin/blob/2.670/samba/samba-lib.pl#L658
- [advisory] https://www.vulncheck.com/advisories/webmin-through-2.670-os-command-injection-via-samba-user-account-options

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.