CVE-2019-15107: Command Injection Vulnerability in Webmin

CVE-2019-15107 is a command injection vulnerability in the 'old' parameter of Webmin's password_change.cgi module, a control panel deployed on tens of thousands of Linux and Unix servers. An attacker who sends a crafted request to the password change module can execute arbitrary commands with the privileges of the Webmin user—typically root. This vulnerability affects Webmin version 1.920 and earlier releases.

With a CVSS score of 9.8, this vulnerability is rated critical. The flaw has been known since August 16, 2019. In 2026, signals from public repositories indicate ongoing interest in CVE-2019-15107 as part of administrative system security research. The vulnerability status is public: documentation exists and signals point to dedicated analysis resources. For system administrators, this remains a concrete threat on unpatched instances.

System administrators and IT teams must verify the Webmin version in use immediately. If the version is 1.920 or earlier, patching is a priority. While awaiting updates, restrict access to the password_change.cgi module to trusted networks only, and check Webmin logs for suspicious attempts. Disable remote access to the module if possible. Monitor system logs (syslog, auditd) for elevated-privilege commands executed in correlation with Webmin access.