CVE-2019-12840: Webmin

High severity, CVSS 8.8. EPSS: 77.5% chance of exploitation in the next 30 days.

In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.

Affected products

• Webmin Webmin: up to and including 1.910

Published 2019-06-15. Last modified 2026-06-17.