CVE-2025-43920

Deeper analysis

GNU Mailman 2.1.39, as included in cPanel and WHM installations, contains an OS command injection flaw (CWE-78) that affects certain external archiver configurations. The vulnerability permits unauthenticated remote attackers to supply shell metacharacters in an email Subject header, resulting in arbitrary command execution on the underlying system. The issue carries a CVSS 3.1 score of 5.4 reflecting high attack complexity and limited impact scope.

An attacker can exploit the flaw by sending a single crafted email whose Subject line reaches the archiver code path; successful exploitation yields limited confidentiality and integrity impact without requiring authentication or user interaction. Multiple third-party reports indicate the condition could not be reproduced under either cPanel or standalone Mailman deployments.

Public references include the upstream Mailman 2.1 branch, a cPanel-specific Python 3 port, an oss-security disclosure thread, and a proof-of-concept repository. No official patch or configuration workaround details are provided in the available references. The associated EPSS score remains low, with a current value of 0.0096 and a peak of 0.0137.