CVE-2025-43921

GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.

Affected

GNU · Mailman

CVSS v3.1 NVD

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.47% chance of exploitation in the next 30 days, 40th percentile

Published

2025-04-20

Updated

2025-04-28

Proof-of-concept exploits (1)

• 0NYX-MY7H/CVE-2025-439210★ · 2025-04-20

Security advisories

• https://code.launchpad.net/~mailman-coders/mailman/2.1

References

• CVE Record
• NVD entry

Related

• CVE-2025-43919
• CVE-2025-43920