Description

GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line.

Remediation

References

CVE-2025-43920

Related Vulnerabilities

MongoDb Improperly Controlled Sequential Memory Allocation Vulnerability (CVE-2026-13056)

Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-2196)

MySQL CVE-2018-3251 Vulnerability (CVE-2018-3251)

WordPress Plugin WordPress File Upload Arbitrary File Upload (3.4.0)

Resin Application Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2010-2032)

Severity

High

Classification

CVE-2025-43920 CWE-138 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities