CVE-2022-35132

Deeper analysis

CVE-2022-35132 is an OS command injection vulnerability, tracked under CWE-78, that affects Usermin versions through 1.850. The flaw resides in the GPG module and permits a remote authenticated user to supply a malicious filename that results in arbitrary command execution on the underlying operating system. The issue carries a CVSS 3.1 base score of 8.8, reflecting network attack vector, low complexity, low required privileges, and high impact on confidentiality, integrity, and availability.

An authenticated attacker who can reach the GPG functionality can therefore execute operating-system commands with the privileges of the Usermin process, enabling actions such as reading or modifying sensitive files, installing persistent access mechanisms, or pivoting further into the environment.

Public references point to the Webmin project’s change log at webmin.com/uchanges.html and an accompanying GitHub repository that document the vulnerability and the corresponding fixes released in subsequent Usermin updates; administrators are advised to upgrade to a patched version to eliminate the injection vector. The associated EPSS score has remained stable at 0.12 with no material upward trajectory after disclosure.