Arbitrary Command Execution Vulnerability in GNU Mailman by cPanel
CVE-2025-43920

5.4MEDIUM

Key Information:

Vendor
Gnu
Status
Mailman
Vendor
CVE Published:
20 April 2025

Badges

👾 Exploit Exists🟡 Public PoC

Summary

An arbitrary command execution vulnerability exists in GNU Mailman 2.1.39, bundled with cPanel and WHM, that permits unauthenticated attackers to execute arbitrary operating system commands. This occurs due to improper handling of shell metacharacters within the email Subject lines, potentially leading to exploitation of the system. Administrators should implement mitigation strategies immediately to safeguard against unauthorized access and command execution.

Affected Version(s)

Mailman 2.1.39

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-43920
Created by 0NYX-MY7H

References

https://code.launchpad.net/~mailman-coders/mailman/2.1
https://github.com/0NYX-MY7H/CVE-2025-43920

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

.