The vulnerability allows an attacker to inject OS commands because the web interface does not escape the user parameter that is passed as the final argument to the system‑level htpasswd utility. This flaw is a classic command injection flaw, classified as CWE‑78, and permits arbitrary code execution on the host that runs the CGI script.

The affected product is Web::Passwd from EVANK, available up to version 0.03. The application has not been updated since 2007 and is considered abandoned. Systems that still host any supported version of this CGI should be aware of the risk.

The flaw is immediately exploitable from a remote web request that supplies a malicious user value. With a CVSS score of 9.8, the vulnerability is classified as Critical. The EPSS score is reported as <1%, indicating a very low but non‑zero likelihood of exploitation, yet the absence of input validation combined with the ability to run arbitrary commands results in a high exploitation potential. Although it is not listed in the CISA KEV catalog, the impact remains severe and the risk persists because the vendor will not issue a patch.