CVE-2025-63261

HighPublic PoC

Published: 20 March 2026

Published

20 March 2026

Modified

07 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0007 21.7th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-63261 is a high-severity OS Command Injection (CWE-78) vulnerability in Awstats Awstats. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked at the 21.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-63261 is a command injection vulnerability in AWStats 8.0 via the open function, classified under CWE-78 (OS Command Injection). The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), highlighting its high severity for local exploitation. It was published on 2026-03-20T21:17:12.800.

A local attacker with low privileges can exploit this vulnerability with low attack complexity and no user interaction. Exploitation enables arbitrary command execution, resulting in high impacts to confidentiality, integrity, and availability on the affected system.

Advisories and related resources include the Debian LTS announcement at https://lists.debian.org/debian-lts-announce/2026/03/msg00013.html, a pentest-tools report detailing code execution at https://pentest-tools.com/PTT-2025-021-Code-Execution-in-AWStats.pdf, and the AWStats source code at https://github.com/eldy/AWStats/blob/develop/wwwroot/cgi-bin/awstats.pl, which provide further details on mitigation and patches.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-208911

Vulnerability details

AWStats 8.0 is vulnerable to Command Injection via the open function

CWE(s): CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Local OS command injection (CWE-78) directly enables arbitrary Unix shell command execution (T1059.004) and can be leveraged for privilege escalation (T1068) due to high impact from low-privileged context.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1