Webmin versions up to 2.670 contain an unvalidated command injection flaw in the code handling Samba user account options. An authenticated Samba user maintainer can supply specially crafted "opts" parameters through the Samba user creation or modification interfaces, causing the backend script to execute arbitrary shell commands with root privileges. The vulnerability stems from improper input handling (CWE‑78) and can lead to full system compromise.

The flaw affects all installations of Webmin that rely on the samba module and run up to version 2.670. Any system where the Webmin web server is enabled and administrators have retained Samba account management capabilities is potentially exposed. The list of affected vendors and products is limited to Webmin, but specific deployment configurations determine the impact.

The CVSS score of 8.6 indicates a high severity vulnerability. The EPSS score is not available, so the exploitation probability is unknown, but the lack of a KEV listing suggests it has not yet been widely reported. Attackers must first authenticate as a Samba user maintainer, implying a local or privileged access requirement. Once authenticated, they can inject and run arbitrary root commands via a back‑quote mechanism present in the "backquote_logged" field, giving them complete control over the affected system.