EVANK Web::Passwd up to version 0.03 for Perl contains a command injection vulnerability (CWE-78) due to improper neutralization of special elements in the 'user' parameter. This parameter is used directly on the command line with the htpasswd command without validation or escaping, enabling an attacker to execute arbitrary OS commands remotely. The CVSS 3.1 base score is 9.8, reflecting the critical impact and ease of exploitation over the network without privileges or user interaction.

Successful exploitation allows remote attackers to execute arbitrary operating system commands with the privileges of the web server process, resulting in full compromise of confidentiality, integrity, and availability of the affected system. This can lead to unauthorized access, data theft, service disruption, or further network penetration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid exposing the Web::Passwd CGI application to untrusted networks or inputs. Applying input validation or escaping on the 'user' parameter before it is passed to system commands is recommended as a temporary mitigation.