Webmin CVE-2025-67738

Exploitation requires that Webmin's Squid module is installed and the Cache Manager feature is available (a non-default deployment choice), AND that the attacker can authenticate to Webmin with an account granted the Squid Cache Manager 'cms' security option. The affected code path is squid/cachemgr.cgi in Webmin before 2.600. Limiting factors: valid Webmin authentication is required (PR:L per CVSS), the specific Squid Cache Manager permission must be assigned, and the Squid module must be deployed - so the realistic attacker is a semi-trusted/low-privilege Webmin user, not an anonymous remote party. Impact is amplified because Webmin generally runs as root, so successful injection yields full host control.

The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C, C:H/I:H/A:H, base 8.5 High) describes a network-reachable but privilege-gated flaw: an attacker must already authenticate to Webmin and hold the Squid Cache Manager 'cms' permission (PR:L), after which OS command injection via unquoted arguments yields a scope change (S:C) to full host compromise - consistent with Webmin typically running as root. Real-world risk signals are mixed and point to LOW immediate urgency: EPSS is only 0.36% (28th percentile), there is no CISA KEV listing, and no public exploit code was identified (the GitHub link is the vendor's own patch commit, not a POC). No SSVC decision data was provided. The authentication-plus-specific-permission precondition means this is a privilege-escalation primitive for semi-trusted Webmin users rather than a mass-exploitable perimeter bug, which aligns with the low EPSS. Note one tension to verify: the official vector rates AC:H, yet the root cause is a classic failure to quote shell arguments ('does not properly quote arguments'), which is normally low-complexity to exploit once the permission is held - the AC:H rating may overstate exploitation difficulty. Overall this is a legitimately serious post-authentication local-privilege-escalation issue but not a drop-everything perimeter emergency; prioritize for environments where untrusted or semi-trusted users have Webmin accounts with Squid Cache Manager access.

A low-privilege Webmin user who has been granted the Squid module's Cache Manager ('cms') permission submits a crafted Cache Manager request whose argument values contain shell metacharacters. Because squid/cachemgr.cgi passes @ARGV unquoted into an open() pipe, the injected command executes on the host - typically as root, since Webmin runs with elevated privileges. No public exploit code was identified at time of analysis; only the vendor patch commit is available.