VulnerabilityDeferred

CVE-2026-8500

Web::Passwd versions through 0.03 for Perl is vulnerable to RCE.

CRITICAL 9.8EPSS 1.65%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.65%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Web::Passwd versions through 0.03 for Perl is vulnerable to RCE. Web::Passwd is a small CGI application for managing htpasswd files using the htpasswd command. The user parameter is not validated or escaped, and is used as the last argument on the command line, allowing for command injection.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.65% probability · 75th percentile
CISA KEV: Not listed
Weakness: CWE-78
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

References

https://httpd.apache.org/docs/current/programs/htpasswd.html
https://metacpan.org/release/EVANK/Web-Passwd-0.03
http://www.openwall.com/lists/oss-security/2026/05/13/8

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.