CVE-2025-67738
squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments.
Published Dec 11, 2025 · updated Oct 14, 2026
squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Dec 11, 2025 · NIST NVD
Detected
squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).
Oct 14, 2026 · NIST NVD
Updated
squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).
Sources
- CVE.orgVulnerability recordCVE-2025-67738
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2025-67738
30-day exploitation probability 0.4%
first.org - NIST NVDVulnerability recordCVE-2025-67738
squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" securi
nvd.nist.gov