Vulnerability record · CVE-2012-2982 · published 11 September 2012
CVE-2012-2982: Webmin file/show.cgi command injection via pathname
Gentoo · Webmin
Webmin 1.590 and earlier fails to sanitize pathnames in file/show.cgi, allowing an authenticated remote user to inject shell metacharacters such as a pipe and execute arbitrary commands. Because Webmin commonly runs with elevated privileges, successful exploitation can lead to full control of the host.
Description
file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as demonstrated by a | (pipe) character.
AV:N/AC:L/Au:S/C:P/I:P/A:P
Automated analysis
high priorityPublic exploit code and a very high EPSS score make this command injection a realistic target despite the authentication requirement.
What it is
Webmin 1.590 and earlier fails to sanitize pathnames in file/show.cgi, allowing an authenticated remote user to inject shell metacharacters such as a pipe and execute arbitrary commands. Because Webmin commonly runs with elevated privileges, successful exploitation can lead to full control of the host.
Impact
An attacker with valid Webmin credentials gains arbitrary command execution on the server, typically with the privileges of the Webmin process, which is often root.
Attack surface
Reached over the network through the Webmin web interface at file/show.cgi; the CVSS vector (AV:N/AC:L/Au:S) indicates authentication is required and no user interaction beyond the crafted request.
Exploitation
Not listed in CISA KEV and no ransomware usage documented, but EPSS is very high (0.62, 99th percentile) and a reference is tagged Exploit, indicating public exploit code exists.
What to do
- Upgrade Webmin to a version later than 1.590, applying the upstream fix commit 1f1411fe7404ec3ac03e803cfa7e01515e71a213.
- Restrict network access to the Webmin interface to trusted management hosts or a VPN.
- Enforce strong unique credentials and least-privilege accounts for Webmin users.
- Run the Webmin service as a non-root user where operationally feasible.
- Monitor for and remove any unsupported or embedded Webmin instances that cannot be patched.
Detection
- Review Webmin access logs for requests to file/show.cgi containing pipe or other shell metacharacters in path parameters.
- Alert on unexpected child processes spawned by the Webmin process, especially shells or command interpreters.
- Monitor for outbound connections or file changes originating from the Webmin service account.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2012-2982 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-2982), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
