CVE-2025-67738: 
Webmin vulnerability analysis and mitigation

CVE-2025-67738 is an OS command injection vulnerability in Webmin's Squid Cache Manager CGI script (squid/cachemgr.cgi) affecting all versions prior to 2.600. The flaw arises from improper argument quoting when passing user-supplied arguments to the cachemgr binary via shell commands. It was published on December 11, 2025, and carries a CVSS v3.1 base score of 8.5 (High) (Red Hat CVE, Feedly). Exploitation requires the Squid module and Cache Manager feature to be enabled, and the attacker must be authenticated with specific Cache Manager (cms) permissions.

The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). In squid/cachemgr.cgi, command-line arguments (@ARGV) were concatenated directly into a shell open() call without sanitization: open(MGR, "$mgr ".join(" ", @ARGV)." |"). This allowed shell metacharacters in attacker-controlled arguments to break out of the intended command context and inject arbitrary OS commands. The fix, introduced in commit 1a52bf4, applies Perl's quotemeta() to each argument before joining them, preventing shell interpretation of special characters (GitHub Commit). Exploitation requires network access to Webmin, low-privilege authentication, and the cms security option granted to the attacker's account.

Successful exploitation allows an authenticated low-privilege attacker to execute arbitrary OS commands on the Webmin host with the privileges of the web server process, typically root or a highly privileged account. This results in high impact to confidentiality, integrity, and availability — an attacker could exfiltrate sensitive data, modify system configurations, install backdoors, or disrupt services. The CVSS scope is marked as Changed, indicating that a successful attack can affect resources beyond the vulnerable component itself, enabling potential lateral movement within the network (Red Hat CVE, Feedly).

As of the time of reporting, no public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation (Feedly). The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.039%, reflecting a currently low probability of exploitation in the near term. Exploitation is constrained by the requirement for authenticated access with specific cms permissions and the Squid Cache Manager feature being enabled, which limits the attack surface.

1. Reconnaissance: Identify internet-facing Webmin instances running versions prior to 2.600 using tools like Shodan or Censys, filtering for Webmin's default port (10000/TCP).
2. Obtain credentials: Acquire or use existing low-privilege Webmin credentials for an account that has been granted the Cache Manager (cms) security option within the Squid module.
3. Verify feature availability: Confirm that the Squid module and Cache Manager feature are enabled in the target Webmin installation.
4. Craft malicious request: Submit a request to squid/cachemgr.cgi with arguments containing shell metacharacters (e.g., ;, |, $()) to inject an OS command — for example, appending ; id or a reverse shell payload to the CGI arguments.
5. Achieve code execution: The unquoted arguments are passed directly to the shell open() call, causing the injected command to execute on the server with the privileges of the Webmin process (GitHub Commit).

• Network: Unexpected outbound connections from the Webmin server to external IPs following requests to squid/cachemgr.cgi; unusual traffic on port 10000 from untrusted sources.
• Logs: Webmin access logs showing requests to /squid/cachemgr.cgi with URL-encoded shell metacharacters (;, |, $(, `) in query parameters or POST body; repeated authentication attempts from unfamiliar IPs.
• Process: Unusual child processes spawned by the Webmin Perl process (e.g., /bin/sh, bash, curl, wget, nc, python) visible in process trees.
• File System: New or modified files in web-accessible directories, unexpected cron jobs, or new user accounts created on the system after exploitation.

The primary remediation is to upgrade Webmin to version 2.600 or later, which applies proper quotemeta() quoting to all CGI arguments before shell execution (GitHub Commit, GitHub Compare). If immediate upgrade is not possible, disable the Squid module and Cache Manager feature within Webmin, or revoke the cms security permission from all non-administrative users. Additionally, restrict Webmin access to trusted IP ranges using firewall rules, and enforce strong authentication (e.g., two-factor authentication) for all Webmin accounts.

Red Hat has acknowledged the vulnerability and published a CVE advisory page (Red Hat CVE). ENISA has catalogued the vulnerability under EUVD-2025-202665. No significant public researcher commentary, social media discussion, or major media coverage has been identified beyond standard vulnerability database entries.