CVE-2025-43920

CVE-2025-43920: Command Injection via Email Subject in GNU Mailman 2.1.39 cPanel/WHM Bundle Discovered by: Firudin Davudzada & Musazada Aydan Disclosure Date: April 2025 CVE ID: CVE-2025-43920 Severity: 5.4 Medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N Attack Type: Remote Affected Software:...

Exploit for OS Command Injection in Gnu Mailman

CVE-2025-43920: Command Injection via Email Subject in GNU Mai...

CVE-2025-43920

GNU Mailman 2.1.39, as bundled in cPanel and WHM, in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardles...

Mailman 1.1 + external archiver vulnerability

SUMMARY Mailman from www.list.org is a mailing list manager with strong Web functionality. If a site is running Mailman 1.1 with an external archiving mechanism that uses the internal variable listnames, list administrators can run any command with the Webserver's uid/gid. A patch is available at...