CVE-2026-8500

Web::Passwd versions through 0.03 for Perl is vulnerable to RCE

CVSS 9.8 CRITICALEPSS 1.7%CWE-78

Vexday Risk Score

28Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 9.8EPSS 1.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

13 may 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Web::Passwd versions through 0.03 for Perl is vulnerable to RCE. Web::Passwd is a small CGI application for managing htpasswd files using the htpasswd command. The user parameter is not validated or escaped, and is used as the last argument on the command line, allowing for command injection.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Productos afectados

EVANK · Web::Passwd

Referencias

https://httpd.apache.org/docs/current/programs/htpasswd.html https://metacpan.org/release/EVANK/Web-Passwd-0.03 http://www.openwall.com/lists/oss-security/2026/05/13/8