virtualmin-other
Warn
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The
install-plugin.shscript allows for the installation of Virtualmin plugins from arbitrary URLs or file paths using thevirtualmin install-plugin --sourcecommand. This enables the execution of remote code within the privileged hosting environment. - [COMMAND_EXECUTION]: Multiple scripts, including
create-cron-job.shandmass-update-domains.sh, execute administrative commands withsudo. Specifically,create-cron-job.shallows the creation of arbitrary scheduled tasks, which can be used for persistence or lateral movement. - [EXTERNAL_DOWNLOADS]: The
install-plugin.shscript facilitates the downloading of external software components (plugins) from remote sources to be installed on the server.
Audit Metadata