CVE-2025-43920

Description

GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.

Reserved 2025-04-19 | Published 2025-04-20 | Updated 2025-04-28 | Assigner mitre

Problem types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Default status
unknown

2.1.39
affected

References

code.launchpad.net/~mailman-coders/mailman/2.1

github.com/0NYX-MY7H/CVE-2025-43920

github.com/cpanel/mailman2-python3

www.openwall.com/lists/oss-security/2025/04/21/6

cve.org (CVE-2025-43920)

nvd.nist.gov (CVE-2025-43920)

Download JSON