Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-43920

Date: April 19, 2025

GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.

Severity Score

Related Resources (6)

https://code.launchpad.net/~mailman-coders/mailman/2.1
https://nvd.nist.gov/vuln/detail/CVE-2025-43920
https://www.openwall.com/lists/oss-security/2025/04/21/6
https://github.com/cpanel/mailman2-python3
https://github.com/0NYX-MY7H/CVE-2025-43920
https://www.mend.io/vulnerability-database/CVE-2025-43920

Severity Score

Weakness Type (CWE)

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us