Vulnerability Description
squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/webmin/webmin/commit/1a52bf4d72f9da6d79250c66e51f41c6f5b880ee
- https://github.com/webmin/webmin/compare/2.520...2.600
- https://webmin.com/security/#privilige-escalation-using-squid-module-cve-2025-67
FAQ
What is CVE-2025-67738?
CVE-2025-67738 is a vulnerability with a CVSS score of 8.5 (HIGH). squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to au...
How severe is CVE-2025-67738?
CVE-2025-67738 has been rated HIGH with a CVSS base score of 8.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-67738?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.