CVE-2025-67738

squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).

Affected products

Red Os, Webmin

Fix

Available

CVSS 3.1

8.5 HIGH

EPSS

0.3% (24th percentile)

Weakness

CWE-78

NVD status

Deferred

Published

2025-12-11

No exploit for CVE-2025-67738 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.