CVE-2015-2775
Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias,...
CVE-2015-2775 is a high vulnerability (CVSS 7.6) in Gnu Mailman, published April 1, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.91%, the 94th percentile. Fixed in mailman 1:2.1.13-6.
- Severity
- 7.6 HighCVSS 2.0, NVD
- Exploit chance
- 7.91%EPSS, 94th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1:2.1.13-6mailman +29 more
Description
Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mailmanDebian:6.0 | before 1:2.1.13-6, plus listed versions 1:2.1.13-4.11:2.1.13-5 | 1:2.1.13-6 |
mailmanDebian:7 | before 1:2.1.15-1+deb7u1, plus listed versions 1:2.1.15-1 | 1:2.1.15-1+deb7u1 |
mailmanMageia:4 | before 2.1.20-1.1.mga4 | 2.1.20-1.1.mga4 |
mailmanRed Hat:enterprise_linux:7::server | before 3:2.1.15-21.ael7b_1 | 3:2.1.15-21.ael7b_1 |
mailman-debuginfoRed Hat:enterprise_linux:7::server | before 3:2.1.15-21.ael7b_1 | 3:2.1.15-21.ael7b_1 |
mailmanRed Hat:enterprise_linux:7::workstation | before 3:2.1.15-21.el7_1 | 3:2.1.15-21.el7_1 |
mailman-debuginfoRed Hat:enterprise_linux:7::workstation | before 3:2.1.15-21.el7_1 | 3:2.1.15-21.el7_1 |
mailmanRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 3:2.1.12-25.el6 | 3:2.1.12-25.el6 |
mailman-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 3:2.1.12-25.el6 | 3:2.1.12-25.el6 |
mailmanRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs | before 3:2.1.12-25.el6 | 3:2.1.12-25.el6 |
Show 20 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mailman-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs | before 3:2.1.12-25.el6 | 3:2.1.12-25.el6 |
mailmanSUSE:OpenStack Cloud 7 From an advisory covering 5 CVEs | before 2.1.17-3.3.3 | 2.1.17-3.3.3 |
mailmanSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 5 CVEs | before 2.1.17-3.3.3 | 2.1.17-3.3.3 |
mailmanSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 5 CVEs | before 2.1.17-3.3.3 | 2.1.17-3.3.3 |
mailmanSUSE:Linux Enterprise Server 12-LTSS From an advisory covering 5 CVEs | before 2.1.17-3.3.3 | 2.1.17-3.3.3 |
mailmanSUSE:Linux Enterprise Server 12 SP1-LTSS From an advisory covering 5 CVEs | before 2.1.17-3.3.3 | 2.1.17-3.3.3 |
mailmanSUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 5 CVEs | before 2.1.17-3.3.3 | 2.1.17-3.3.3 |
mailmanSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 5 CVEs | before 2.1.17-3.3.3 | 2.1.17-3.3.3 |
mailmanSUSE:Linux Enterprise Server 12 SP3 From an advisory covering 5 CVEs | before 2.1.17-3.3.3 | 2.1.17-3.3.3 |
mailmanSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 5 CVEs | before 2.1.17-3.3.3 | 2.1.17-3.3.3 |
mailmanSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 5 CVEs | before 2.1.17-3.3.3 | 2.1.17-3.3.3 |
mailmanSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 5 CVEs | before 2.1.17-3.3.3 | 2.1.17-3.3.3 |
mailmanSUSE:Enterprise Storage 4 From an advisory covering 5 CVEs | before 2.1.17-3.3.3 | 2.1.17-3.3.3 |
mailmanSUSE:Linux Enterprise Point of Sale 11 SP3 From an advisory covering 5 CVEs | before 2.1.15-9.6.6.1 | 2.1.15-9.6.6.1 |
mailmanSUSE:Linux Enterprise Server 11 SP3-LTSS From an advisory covering 5 CVEs | before 2.1.15-9.6.6.1 | 2.1.15-9.6.6.1 |
mailmanSUSE:Linux Enterprise Server 11 SP3-TERADATA From an advisory covering 5 CVEs | before 2.1.15-9.6.6.1 | 2.1.15-9.6.6.1 |
mailmanSUSE:Linux Enterprise Server 11 SP4 From an advisory covering 5 CVEs | before 2.1.15-9.6.6.1 | 2.1.15-9.6.6.1 |
mailmanSUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 5 CVEs | before 2.1.15-9.6.6.1 | 2.1.15-9.6.6.1 |
mailmanUbuntu:14.04:LTS | before 1:2.1.16-2ubuntu0.1, plus listed versions 1:2.1.16~rc2-11:2.1.16-11:2.1.16-2 | 1:2.1.16-2ubuntu0.1 |
mailmanopenSUSE:Tumbleweed From an advisory covering 3 CVEs | before 2.1.23-1.2 | 2.1.23-1.2 |
What each source reports
NVD Score used
Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.
- Record
CVE-2015-2775- CVSS 2.0
- 7.6 High
AV:N/AC:H/Au:N/C:C/I:C/A:C - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE ListNo score
Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.
- Record
CVE-2015-2775- Updated
- 2026-11-02
EUVDEUVD-2015-2865No score
Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.
- Record
EUVD-2015-2865- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rhjr-qgg7-67wgNo score
Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias,...
Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.
- Record
GHSA-rhjr-qgg7-67wg- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVMGASA-2015-0205No score
Updated mailman packages fix security vulnerabilities
Updated mailman packages fix security vulnerability:
A path traversal vulnerability was discovered in Mailman. Installations using a transport script (such as postfix-to-mailman.py) to interface with their MTA instead of static aliases were vulnerable to a path traversal attack. To successfully exploit this, an attacker needs write access on the local file system (CVE-2015-2775).
- Record
MGASA-2015-0205- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10215-1No score
mailman-2.1.23-1.2 on GA media
These are all security issues fixed in the mailman-2.1.23-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10215-1- Updated
- 2026-11-02
Show 4 moreShow less
OSVSUSE-SU-2018:4296-1No score
Security update for mailman
This update for mailman fixes the following security vulnerabilities:
- Fixed a XSS vulnerability and information leak in user options CGI, which could be used to execute arbitrary scripts in the user's browser via specially encoded URLs (bsc#1077358 CVE-2018-5950)
- Fixed a directory traversal vulnerability in MTA transports when using the recommended Mailman Transport for Exim (bsc#925502 CVE-2015-2775)
- Fixed a XSS vulnerability, which allowed malicious listowners to inject scripts into the listinfo pages (bsc#1099510 CVE-2018-0618)
- Fixed arbitrary text injection vulnerability in several mailman CGIs (CVE-2018-13796 bsc#1101288)
- Fixed a CSRF vulnerability on the user options page (CVE-2016-6893 bsc#995352)
- Record
SUSE-SU-2018:4296-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:13924-1No score
Security update for mailman
This update for mailman fixes the following issues:
- Fixed a XSS vulnerability and information leak in user options CGI, which could be used to execute arbitrary scripts in the user's browser via specially encoded URLs (bsc#1077358 CVE-2018-5950)
- Fixed a directory traversal vulnerability in MTA transports when using the recommended Mailman Transport for Exim (bsc#925502 CVE-2015-2775)
- Fixed a XSS vulnerability, which allowed malicious listowners to inject scripts into the listinfo pages (bsc#1099510 CVE-2018-0618)
- Fixed arbitrary text injection vulnerability in several mailman CGIs (CVE-2018-13796 bsc#1101288)
- Fixed a CSRF vulnerability on the user options page (CVE-2016-6893 bsc#995352)
- Record
SUSE-SU-2019:13924-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-2775No score
Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.
- Record
UBUNTU-CVE-2015-2775- Updated
- 2026-11-02
OSVUSN-2558-1No score
mailman vulnerability
It was discovered that Mailman incorrectly handled special characters in list names. A local attacker could use this issue to perform a path traversal attack and execute arbitrary code as the Mailman user.
- Record
USN-2558-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
bugs.launchpad.net/mailman/+bug/1437145
debian.org/security/2015/dsa-3214
rhn.redhat.com/errata/RHSA-2015-1153.html
lists.fedoraproject.org/pipermail/package-announce/2015-April/154911.html
ubuntu.com/usn/USN-2558-1
Show 44 moreShow less
mail.python.org/pipermail/mailman-developers/2015-March/024871.html
securitytracker.com/id/1032033
securityfocus.com/bid/73922
nvd.nist.gov/vuln/detail/CVE-2015-2775
github.com/advisories/GHSA-rhjr-qgg7-67wg
advisories.mageia.org/MGASA-2015-0205.html
bugs.mageia.org/show_bug.cgi?id=15648
access.redhat.com/errata/RHSA-2015:1153
bugzilla.redhat.com/show_bug.cgi?id=1208059
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1153.json
cve.org/CVERecord?id=CVE-2015-2775
suse.com/support/update/announcement/2018/suse-su-20184296-1
bugzilla.suse.com/1077358
ubuntu.com/security/CVE-2015-2775