diff --git a/meta-webserver/recipes-webadmin/webmin/files/CVE-2026-125391.patch b/meta-webserver/recipes-webadmin/webmin/files/CVE-2026-125391.patch
new file mode 100644
index 0000000000..077adc95d5
--- /dev/null
+++ b/meta-webserver/recipes-webadmin/webmin/files/CVE-2026-125391.patch
@@ -0,0 +1,37 @@
+From 86791cd2bd1848b3967dc86ae0909493e768db7e Mon Sep 17 00:00:00 2001
+From: Ilia Ross <ilia@ross.gdn>
+Date: Sun, 8 Nov 2026 17:38:12 +0100
+Subject: [PATCH] Fix Samba account option command injection
+
+(cherry picked from commit 18cab89b1fc74ab7e8b1b8b90bbccbe5aba99154)
+CVE: CVE-2026-125391
+Upstream-Status: Backport [https://github.com/webmin/webmin/commit/18cab89b1fc74ab7e8b1b8b90bbccbe5aba99154]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ samba/samba-lib.pl | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/samba/samba-lib.pl b/samba/samba-lib.pl
+index bafd03b8b..2bd90ba26 100755
+--- a/samba/samba-lib.pl
++++ b/samba/samba-lib.pl
+@@ -656,7 +656,8 @@ if ($has_pdbedit) {
+ 		"cd / && $config{'pdbedit'} -a -s $config{'smb_conf'} -t -u ".
+ 		quotemeta($user->{'name'}).
+ 		($config{'sync_gid'} ? " -g $config{'sync_gid'}" : "").
+-		" -c '[".join("", @opts)."]' $ws <$temp 2>&1");
++		" -c ".quotemeta("[".join("", @opts)."]").
++		" $ws <$temp 2>&1");
+ 	$? && &error("$config{'pdbedit'} failed : <pre>$out</pre>");
+ 	}
+ else {
+@@ -700,7 +701,8 @@ if ($has_pdbedit) {
+ 		$out = &backquote_logged(
+ 			"cd / && $config{'pdbedit'} -r -s $config{'smb_conf'} -u ".
+ 			quotemeta($_[0]->{'name'}).
+-			" -c '[".join("", @opts)."]' 2>&1");
++			" -c ".quotemeta("[".join("", @opts)."]").
++			" 2>&1");
+ 		$? && &error("$config{'pdbedit'} failed : <pre>$out</pre>");
+ 		}
+ 	}
diff --git a/meta-webserver/recipes-webadmin/webmin/webmin_2.653.bb b/meta-webserver/recipes-webadmin/webmin/webmin_2.653.bb
index a46c3aad16..e4380e16a0 100644
--- a/meta-webserver/recipes-webadmin/webmin/webmin_2.653.bb
+++ b/meta-webserver/recipes-webadmin/webmin/webmin_2.653.bb
@@ -17,6 +17,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/webadmin/webmin-${PV}.tar.gz \
            file://media-tomb.patch \
            file://mysql-config-fix.patch \
            file://webmin.service \
+           file://CVE-2026-125391.patch \
             "
 SRC_URI[sha256sum] = "9acc680d3d45cee876f36fc8810ce68bb6e44a0365e245a4298a180e0d016696"
 UPSTREAM_CHECK_URI = "http://www.webmin.com/download.html"