CVE-2025-43920

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
GNU	Mailman	2.1.39

References

https://code.launchpad.net/~mailman-coders/mailman/2.1Product
https://github.com/0NYX-MY7H/CVE-2025-43920Exploit, Third Party Advisory
https://github.com/cpanel/mailman2-python3
https://www.openwall.com/lists/oss-security/2025/04/21/6

Timeline

Published: Apr 20, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-439215.3GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE:CVE-2025-439228.1The FileWave Windows client before 16.0.0, in some non-default configurations, allows an unprivileged local user to escalate privileges to S CVE-2025-439236.5An issue was discovered in ReportController in Unicom Focal Point 7.6.1. A user who has administrative privilege in Focal Point can perform CVE-2025-439246.1Cross Site Scripting vulnerability was discovered in Unicom Focal Point 7.6.1. The val parameter in SettingController (for /fp/admin/setting CVE-2025-439254.6An issue was discovered in Unicom Focal Point 7.6.1. The database is encrypted with a hardcoded key, making it easier to recover the clearte CVE-2025-439266.1An issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6. Custom AJAX calls to the AgentPreferences UpdateAJAX subaction can be CVE-2025-439289.8In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal CVE-2025-439297.8open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked f CVE-2025-43936.5Medtronic MyCareLink Patient Monitor has an internal service that deserializes data, which allows a local attacker to interact with the serv CVE-2025-439309.8Hashview 0.8.1 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the CVE-2025-439319.8flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a re CVE-2025-439329.8JobCenter through 7e7b0b2 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depe