3 new CVE's have been published for GNU Mailman 2.1.39, as bundled with cPanel and WHM, credited to Firudin Davudzada and Musazada Aydan.
Note that upstream declared GNU Mailman 2.1 (which requires Python 2), to be end of life back in 2020, and recommends migrations to Mailman 3 (which uses Python 3 instead): https://mail.python.org/archives/list/mailman-annou...@python.org/thread/TJLEX52N2ARNOQBC2ZNYMNV5U226R5NM/ CVE-2025-43919: Directory Traversal in GNU Mailman 2.1.39 (cPanel/WHM Bundle) Details/POC: https://github.com/0NYX-MY7H/CVE-2025-43919 GNU Mailman 2.1.39, as bundled with cPanel and WHM, contains a critical directory traversal vulnerability in the /mailman/private/mailman endpoint. Unauthenticated attackers can exploit this flaw to read arbitrary files on the server, such as /etc/passwd or Mailman configuration files, due to insufficient input validation in the private.py CGI script. CVE-2025-43920: Command Injection via Email Subject in GNU Mailman 2.1.39 (cPanel/WHM Bundle) Details/POC: https://github.com/0NYX-MY7H/CVE-2025-43920 GNU Mailman 2.1.39, as bundled with cPanel and WHM, is vulnerable to a critical command injection flaw that allows unauthenticated attackers to execute arbitrary operating system commands. The vulnerability occurs when an external archiver is configured using PUBLIC_EXTERNAL_ARCHIVER or PRIVATE_EXTERNAL_ARCHIVER in the mm_cfg.py configuration file, and the email subject line contains shell metacharacters that are not properly sanitized. CVE-2025-43921: Unauthenticated Mailing List Creation in GNU Mailman 2.1.39 (cPanel/WHM Bundle) Details/POC: https://github.com/0NYX-MY7H/CVE-2025-43921 GNU Mailman 2.1.39, as bundled with cPanel and WHM, is vulnerable to an authentication bypass flaw that allows unauthenticated attackers to create mailing lists via the /mailman/create endpoint. The issue stems from missing access controls in the create CGI script, enabling attackers to abuse the mailing system for spam, phishing, or resource exhaustion. -- -Alan Coopersmith- alan.coopersm...@oracle.com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
