CVE-2019-12840: Webmin Package Updates module OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRoot-level command execution with public exploit code and very high EPSS, but it requires an authenticated account with Package Updates access, which limits reach compared with an unauthenticated flaw.

What it is

Webmin through 1.910 lets any user authorized for the "Package Updates" module execute arbitrary commands with root privileges via the data parameter to update.cgi. The flaw is OS command injection (CWE-78) in a privileged administrative component, so a low-privileged authenticated user can gain full root control of the host.

Impact

An attacker with Package Updates access runs arbitrary commands as root, leading to complete compromise of the Webmin server and any data or services it manages.

Attack surface

Reachable over the network through the Webmin web interface (AV:N); it requires a valid account authorized to the Package Updates module (PR:L) and no user interaction (UI:N).

Exploitation

Public exploit code exists (Exploit-DB 46984 and a pentest.com.tr advisory tagged Exploit), and EPSS is very high at 0.778 (99.5th percentile), though CISA KEV does not list it.

What to do

• Upgrade Webmin past 1.910 to a fixed release immediately.
• Restrict the Package Updates module to trusted administrators and remove it from non-admin roles.
• Limit network exposure of the Webmin interface to trusted management networks or a VPN.
• Audit Webmin accounts and revoke unused or over-privileged credentials.
• Monitor Webmin logs for unexpected update.cgi requests and child processes spawned by the Webmin service.

Detection

• Alert on POST requests to update.cgi containing shell metacharacters or command separators in the data parameter.
• Monitor for processes spawned by the Webmin service (miniserv.pl) that are not expected package-management binaries.
• Review Webmin access logs for Package Updates module use by accounts that do not normally administer packages.
• Watch for outbound connections or file writes originating from the Webmin process outside normal update activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.