0NYX-MY7H/CVE-2025-43920

0NYX-MY7H/CVE-2025-43920

GitHubGitHub
GitHubgithub.com
Releases0
CVE-2025-43920: Remote Command Injection via Email Subject in GNU Mailman 2.1.39
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2025-43920↗
5.4 MEDIUM—

GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.