CVE search · CVE-2025-63261

CVE-2025-63261

high 7.8

AWStats 8.0 is vulnerable to Command Injection via the open function

Open in the NVD CVE.org JSON

Status: Analyzed
Published: 2026-03-20
Last changed: 2026-06-17
Source: cve@mitre.org
Weakness: CWE-78

Severity

Version	Score	Vector	Source
CVSS 3.1	high 7.8	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`	134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

awstats · awstats
debian · debian_linux

References

https://github.com/eldy/AWStats/blob/develop/wwwroot/cgi-bin/awstats.plProduct
https://pentest-tools.com/PTT-2025-021-Code-Execution-in-AWStats.pdfExploitThird Party Advisory
https://lists.debian.org/debian-lts-announce/2026/03/msg00013.htmlMailing ListThird Party Advisory