CVE-2026-8500CWE-78

Web::Passwd versions through 0.03 for Perl is vulnerable to RCE

Critical · published May 13, 2026

CVSS v3.1
9.8
EPSS
2%
Percentile
84.5
In the wild
Unconfirmed
What it is

Web::Passwd versions through 0.03 for Perl is vulnerable to RCE.

Web::Passwd is a small CGI application for managing htpasswd files using the htpasswd command.

The user parameter is not validated or escaped, and is used as the last argument on the command line, allowing for command injection.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02491 · 84.5th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-05-13T22:24Z
EPSS history
Timeline
  • 13 MAY 22:24Z
    Web::Passwd versions through 0.03 for Perl is vulnerable to RCE
    cvelistv5