VULNERABILITY INTELLIGENCE

CVE-2025-43920

CVSS score5.4 MEDIUM
EPSS probability0.60%
CISA KEVNot currently listed
Published2025-04-20
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Description

GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.

Weakness classification

  • cve@mitre.org: CWE-78
  • nvd@nist.gov: CWE-78

Primary references