EUVD-2026-30206
GHSA-jrw9-jqqp-jcq9
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
Web::Passwd versions through 0.03 for Perl is vulnerable to RCE.
Web::Passwd is a small CGI application for managing htpasswd files using the htpasswd command.
The user parameter is not validated or escaped, and is used as the last argument on the command line, allowing for command injection.
AnalysisAI
Remote code execution in Web::Passwd 0.03 and earlier allows unauthenticated network attackers to execute arbitrary system commands with web server privileges via command injection in the user parameter. The CVSS vector indicates network-accessible, low-complexity exploitation requiring no authentication or user interaction. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
24 hours: Identify all systems running Web::Passwd 0.03 or earlier via asset inventory and dependency scanning; implement network segmentation to restrict access to affected applications. 7 days: Upgrade to Web::Passwd 0.04 or later if vendor patch is released; if unavailable, decommission or isolate the application pending patch availability. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today