CVE-2026-8500

Web::Passwd versions through 0.03 for Perl is vulnerable to RCE

CVSS 9.8 CRITICALEPSS 1.7%CWE-78

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.8EPSS 1.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

13 May 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Web::Passwd versions through 0.03 for Perl is vulnerable to RCE. Web::Passwd is a small CGI application for managing htpasswd files using the htpasswd command. The user parameter is not validated or escaped, and is used as the last argument on the command line, allowing for command injection.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

EVANK · Web::Passwd

References

https://httpd.apache.org/docs/current/programs/htpasswd.html https://metacpan.org/release/EVANK/Web-Passwd-0.03 http://www.openwall.com/lists/oss-security/2026/05/13/8