CVE-2025-43921: Medium severity cpanel gnu mailman vulnerability
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43921?
CVE-2025-43921 is a high-severity vulnerability that allows unauthenticated attackers to create email lists.
How do I fix CVE-2025-43921?
To mitigate CVE-2025-43921, you should upgrade to the latest version of GNU Mailman that addresses this vulnerability.
What versions of GNU Mailman are affected by CVE-2025-43921?
CVE-2025-43921 specifically affects GNU Mailman version 2.1.39 and earlier versions deployed in certain configurations.
What impact does CVE-2025-43921 have on my server?
This vulnerability can lead to unauthorized list creation, which could result in spam distribution or further exploitation.
Is CVE-2025-43921 exploit publicly known?
Yes, CVE-2025-43921 is a public vulnerability, and proof-of-concept exploits are available, making it critical to apply patches immediately.