CVE-2025-43920

8.1 highEPSS 0.6%

High (8.1) in gnu mailman. EPSS 0.6% chance of exploitation in the next 30 days.

GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.

Severity

CVSS 3.1

8.1 high

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2025-04-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

gnu:mailman

References

https://code.launchpad.net/~mailman-coders/mailman/2.1
https://github.com/0NYX-MY7H/CVE-2025-43920
https://github.com/cpanel/mailman2-python3
https://www.openwall.com/lists/oss-security/2025/04/21/6

Check your stack JSON