Executive brief
Web::Passwd is a Perl-based web application used to manage website password files. A security flaw allows attackers to inject malicious commands through the username field because the application does not properly check user input before passing it to the underlying system. This could allow an unauthorized person to take complete control of the web server, potentially leading to data theft or service disruption.
Technical details
Web::Passwd is vulnerable to OS command injection (CWE-78) because it fails to validate or escape the 'user' parameter before using it as an argument in a system call to the 'htpasswd' utility. An attacker can provide a specially crafted username containing shell metacharacters to execute arbitrary commands with the privileges of the web server process. This vulnerability affects all versions up to and including 0.03. As the software has been abandoned since 2007, no official patch is available, and users are advised to migrate to maintained alternatives.
Affected products
- EVANK Web::Passwd through 0.03
Timeline
- 2007-02-08: other: Version 0.03 released
- 2026-05-13: disclosed: Vulnerability disclosed via Openwall oss-security list
- 2026-05-13: advisory: CVE-2026-8500 published