Analytical use of cookies
CVE-2025-43919CVSS 5.8Runtime
CVE-2025-43919: mailman vulnerability
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the private archive authentication endpoint) via the username parameter. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
- CVSS
- 5.8 MEDIUM
- EPSS
- 69.29%
- Активно використовується
- немає в KEV
- Продукт
- mailman
Що відомо
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the private archive authentication endpoint) via the username parameter. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.