CVE-2025-43921

MEDIUM 5.3CVE-2025-43921 · Published 20/04/2025 · updated 17/06/2026

In short

CVE-2025-43921 is a MEDIUM (CVSS 5.3) vulnerability affecting mailman (gnu).
Chance of exploitation in the next 30 days (EPSS): 0.48%, higher than 41.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
mailman gnu	`≥ 2.1.1, ≤ 2.1.39`	No fix yet

Description

GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.

References

code.launchpad.net/~mailman-coders/mailman/2.1 · Product
0NYX-MY7H/CVE-2025-43921 · Exploit
cpanel/mailman2-python3
openwall.com/lists/oss-security/2025/04/21/6

More vulnerabilities in mailman

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mailman

gnu

≥ 2.1.1, ≤ 2.1.39

No fix yet

More vulnerabilities in mailman

See all →