Description

GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line.

Remediation

References

CVE-2025-43920

Related Vulnerabilities

MySQL CVE-2024-20961 Vulnerability (CVE-2024-20961)

WordPress 4.6.x Multiple Vulnerabilities (4.6 - 4.6.8)

LimeSurvey Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2024-42902)

WordPress Plugin BuddyPress Cross-Site Scripting (2.2.2.1)

Coppermine Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-1613)

Severity

High

Classification

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-138 CVE-2025-43920