CVE-2025-43919: Path Traversal
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the private archive authentication endpoint) via the username parameter. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43919?
CVE-2025-43919 is classified as a high severity vulnerability due to its potential for unauthorized file access.
How do I fix CVE-2025-43919?
To mitigate CVE-2025-43919, update GNU Mailman to the latest version to eliminate directory traversal vulnerabilities.
What systems are affected by CVE-2025-43919?
CVE-2025-43919 primarily affects GNU Mailman 2.1.39 bundled with cPanel and WHM.
What kind of attack utilizes CVE-2025-43919?
CVE-2025-43919 can be exploited by unauthenticated attackers through directory traversal attacks via the username parameter.
Is authentication required to exploit CVE-2025-43919?
No, CVE-2025-43919 does not require authentication, making it accessible to unauthenticated attackers.