CVE-2025-67738
squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments.
Published Dec 11, 2025 · updated Oct 14, 2026
squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).
Timeline
Detection, updates, and resolution for this record.
Dec 11, 2025 · NIST NVD
Detected
squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).
Oct 14, 2026 · NIST NVD
Updated
squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).
Sources
- CVE.orgCVE-2025-67738
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-67738
30-day exploitation probability 0.4%
first.org - NIST NVDCVE-2025-67738
squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" securi
nvd.nist.gov