CVE-2015-2775

High

Published: 13/04/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.

Risk Assessment

Attackers can exploit this vulnerability to execute unauthorized scripts or files, potentially leading to serious security breaches in the system.

Recommendation

It is recommended to upgrade GNU Mailman to version 2.1.20 or later and implement static aliases to minimize risk.

Other vulnerabilities in GNU Mailman

CVE-2016-7123High
A cross-site request forgery (CSRF) vulnerability in the admin web interface in GNU Mailman before version 2.1.15 allows remote attackers to hijack the authentication of administrators.

Original NVD description (English source)

Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.