CVE details
CVE-2025-43919
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the private archive authentication endpoint) via the username parameter. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
Affected ports (3)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| mail/mailman | mailman | 2.1.39_4 | unaddressed | mandree@FreeBSD.org |
| mail/mailman-exim4 | mailman-exim4 | 2.1.39_4 | unaddressed | mandree@FreeBSD.org |
| mail/mailman-postfix | mailman-postfix | 2.1.39_4 | unaddressed | mandree@FreeBSD.org |
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>FIXME</lt></range>
</package>
<package>
<name>mailman-exim4</name>
<range><lt>FIXME</lt></range>
</package>
<package>
<name>mailman-postfix</name>
<range><lt>FIXME</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows
unauthenticated attackers to read arbitrary files via ../ directory
traversal at /mailman/private/mailman (aka the private archive
authentication endpoint) via the username parameter. NOTE: multiple
third parties report that they are unable to reproduce this,
regardless of whether cPanel or WHM is used.</p>
</body>
</description>
<references>
<cvename>CVE-2025-43919</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-43919</url>
</references>
<dates>
<discovery>2025-04-20</discovery>
<entry>2026-10-25</entry>
</dates>
</vuln>