Security Advisory

CVE-2025-43919

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2025-04-20 00:00:00

Last updated 2025-04-28 13:43:23

Assigner mitre

CVSS score 5.8

State PUBLISHED

Description

GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the private archive authentication endpoint) via the username parameter. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.

← Browse all CVEs View on cve.org ↗