High severity · published Apr 20, 2025
CVE-2025-43920
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell…
8.1
CVSS
0.6%
EPSS
No
On KEV
Description
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mailman · Gnu
2.1.1 through 2.1.39 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-43920
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-43920
Product
https://code.launchpad.net/~mailman-coders/mailman/2.1
Exploit
https://github.com/0NYX-MY7H/CVE-2025-43920
github.com
https://github.com/cpanel/mailman2-python3
www.openwall.com
https://www.openwall.com/lists/oss-security/2025/04/21/6
More from Mailman
8.8
CVE-2021-44227
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes
8.8
CVE-2016-7123
Cross-site request forgery (CSRF) vulnerability in the admin web interface in GNU Mailman before 2.1.15 allows remote attackers to hijack the authentication of administrators
8.8
CVE-2016-6893
Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users…
8.0
CVE-2021-42097
GNU Mailman before 2.1.35 may allow remote Privilege Escalation
7.5
CVE-2025-43919
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the…