CVE-2026-59680

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, getpasswordterm in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString, which performs no numeric validation, and passed the resulting...

CVE-2026-59680

An OS command injection vulnerability in yast2-users (through 5.0.8 ) allows root-level command execution via a malicious LDAP directory. The flaw is in get_password_term() in src/include/users/dialogs.rb, which reads the shadowLastChange and shadowExpire attributes via GetString() with no numeri...

EUVD-2026-68996

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, getpasswordterm in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString, which performs no numeric validation, and passed the resulting...