CVE-2025-43920mediumCWE-78

CVE-2025-43920: medium-severity vulnerability in GNU Mailman

Published · Updated

Follow this CVE+ Monitor Mailman

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 0.6%
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected products
GNU · Mailman
Related CVEs — GNU Mailman

In the same product, most dangerous first.

CVE-2025-43919MEDIUMCVE-2025-43919EPSS 1.4%CVE-2025-43921MEDIUMCVE-2025-43921EPSS 0.5%