CVE-2025-63261

HighPublic PoC

Published: 20 March 2026

Published

20 March 2026

Modified

07 April 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0008 23.9th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-63261 is a high-severity OS Command Injection (CWE-78) vulnerability in Awstats Awstats. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked at the 23.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Unix Shell (T1059.004) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the command injection flaw in AWStats 8.0 by identifying, prioritizing, and applying patches or updates.

SI-10 Information Input Validation good match

prevent

Validates untrusted inputs to the open function to block malicious command strings and prevent OS command injection.

AC-6 Least Privilege partial match

prevent

Limits damage from arbitrary command execution by ensuring AWStats and exploited processes operate with least privileges.

MITRE ATT&CK Enterprise TechniquesAI

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Local OS command injection (CWE-78) directly enables arbitrary Unix shell command execution (T1059.004) and can be leveraged for privilege escalation (T1068) due to high impact from low-privileged context.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

AWStats 8.0 is vulnerable to Command Injection via the open function

Deeper analysisAI

CVE-2025-63261 is a command injection vulnerability in AWStats 8.0 via the open function, classified under CWE-78 (OS Command Injection). The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), highlighting its high severity for local exploitation. It was published on 2026-03-20T21:17:12.800.

A local attacker with low privileges can exploit this vulnerability with low attack complexity and no user interaction. Exploitation enables arbitrary command execution, resulting in high impacts to confidentiality, integrity, and availability on the affected system.

Advisories and related resources include the Debian LTS announcement at https://lists.debian.org/debian-lts-announce/2026/03/msg00013.html, a pentest-tools report detailing code execution at https://pentest-tools.com/PTT-2025-021-Code-Execution-in-AWStats.pdf, and the AWStats source code at https://github.com/eldy/AWStats/blob/develop/wwwroot/cgi-bin/awstats.pl, which provide further details on mitigation and patches.