CVE-2025-43920 PUBLISHED

Assigner: mitre
Reserved: 19.04.2025 Published: 20.04.2025 Updated: 20.04.2025

GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS Score: 5.4

Product Status

Vendor GNU
Product Mailman
Versions Default: unknown
  • Version 2.1.39 is affected

References

Problem Types

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE