{"id":"CVE-2015-2775","aliases":["DEBIAN-CVE-2015-2775","DLA-186-1","DSA-3214-1","EUVD-2015-2865","GHSA-rhjr-qgg7-67wg","MGASA-2015-0205","RHSA-2015:1153","RHSA-2015:1417","SUSE-SU-2018:4296-1","SUSE-SU-2019:13924-1","UBUNTU-CVE-2015-2775","USN-2558-1","openSUSE-SU-2024:10215-1"],"status":"published","title":"Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias,...","description":"Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.","severity":{"version":"2.0","score":7.6,"vector":"AV:N/AC:H/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.07908,"percentile":0.94759,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2015-04-01T00:00:00Z","modified":"2026-06-26T10:27:46Z","fixes":[{"ecosystem":"Debian:6.0","package":"mailman","fixed_in":["1:2.1.13-6"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"mailman","fixed_in":["1:2.1.15-1+deb7u1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"mailman","fixed_in":["2.1.20-1.1.mga4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"mailman","fixed_in":["3:2.1.15-21.ael7b_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"mailman-debuginfo","fixed_in":["3:2.1.15-21.ael7b_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mailman","fixed_in":["3:2.1.15-21.el7_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mailman-debuginfo","fixed_in":["3:2.1.15-21.el7_1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"mailman","fixed_in":["1:2.1.16-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.13-6"}]}],"versions":["1:2.1.13-4.1","1:2.1.13-5"]},{"source":"osv","ecosystem":"Debian:7","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.15-1+deb7u1"}]}],"versions":["1:2.1.15-1"]},{"source":"osv","ecosystem":"Mageia:4","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.20-1.1.mga4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.15-21.ael7b_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mailman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.15-21.ael7b_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.15-21.el7_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mailman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.15-21.el7_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.12-25.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mailman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.12-25.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.12-25.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mailman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.12-25.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.3.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.3.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.3.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.3.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.3.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.3.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.3.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.3.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.3.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.3.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.3.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.3.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.15-9.6.6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.15-9.6.6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.15-9.6.6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.15-9.6.6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.15-9.6.6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.16-2ubuntu0.1"}]}],"versions":["1:2.1.16~rc2-1","1:2.1.16-1","1:2.1.16-2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.16-2ubuntu0.1"}]}],"versions":["1:2.1.16~rc2-1","1:2.1.16-1","1:2.1.16-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.23-1.2"}]}],"bundled":3}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"gnu","product":"mailman"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://bugs.launchpad.net/mailman/+bug/1437145","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.debian.org/security/2015/dsa-3214","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1153.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1417.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154911.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://www.ubuntu.com/usn/USN-2558-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156742.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://mail.python.org/pipermail/mailman-developers/2015-March/024871.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory"]},{"url":"https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://mail.python.org/pipermail/mailman-developers/2015-March/024875.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","report"]},{"url":"http://www.securitytracker.com/id/1032033","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.securityfocus.com/bid/73922","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2775","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rhjr-qgg7-67wg"},{"url":"https://advisories.mageia.org/MGASA-2015-0205.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15648","tags":["report"]},{"url":"https://www.debian.org/security/2015/dsa-3214","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1153","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1208059","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1229288","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1229307","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1153.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-2775","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-2775","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1417","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=723584","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=745409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=765807","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1008139","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1056366","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1095359","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1417.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2002-0389","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2002-0389","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2002-0389","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20184296-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1077358","tags":["report"]},{"url":"https://bugzilla.suse.com/1099510","tags":["report"]},{"url":"https://bugzilla.suse.com/1101288","tags":["report"]},{"url":"https://bugzilla.suse.com/925502","tags":["report"]},{"url":"https://bugzilla.suse.com/995352","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5950","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201913924-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-2775","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2558-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0707","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-2775","description":"Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.","status":"published","published":"2015-04-13T14:00:00Z","modified":"2024-08-06T05:24:38.852Z","updated_at":"2026-11-02T14:35:41.976732Z"}],"euvd":[{"id":"EUVD-2015-2865","description":"Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.","status":"published","published":"2015-04-13T14:00:00Z","modified":"2024-08-06T05:24:38Z","updated_at":"2026-11-03T02:22:10.564423Z"}],"ghsa":[{"id":"GHSA-rhjr-qgg7-67wg","title":"Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias,...","description":"Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.","status":"published","published":"2022-05-17T03:17:25Z","modified":"2023-01-27T05:07:23Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:43:06.90939Z"}],"nvd":[{"id":"CVE-2015-2775","description":"Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.","status":"published","published":"2015-04-13T14:59:02.397Z","modified":"2026-06-17T00:24:43.887Z","cvss":[{"version":"2.0","score":7.6,"vector":"AV:N/AC:H/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:03:04.095849Z"}],"osv":[{"id":"DLA-186-1","title":"mailman - security update","status":"published","published":"2015-04-06T00:00:00Z","modified":"2026-03-09T01:22:04.533597Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-3214-1","title":"mailman - security update","status":"published","published":"2015-04-06T00:00:00Z","modified":"2026-03-09T01:20:21.517749Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2015-0205","title":"Updated mailman packages fix security vulnerabilities","description":"Updated mailman packages fix security vulnerability:\n\nA path traversal vulnerability was discovered in Mailman. Installations using\na transport script (such as postfix-to-mailman.py) to interface with their\nMTA instead of static aliases were vulnerable to a path traversal attack. To\nsuccessfully exploit this, an attacker needs write access on the local file\nsystem (CVE-2015-2775).\n","status":"published","published":"2015-05-11T20:10:38Z","modified":"2026-04-16T06:23:25.160946088Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10215-1","title":"mailman-2.1.23-1.2 on GA media","description":"These are all security issues fixed in the mailman-2.1.23-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:33:56.894608Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2015:1153","title":"Red Hat Security Advisory: mailman security and bug fix update","status":"published","published":"2024-09-15T22:27:02Z","modified":"2026-06-26T10:27:28Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:1417","title":"Red Hat Security Advisory: mailman security and bug fix update","status":"published","published":"2024-09-15T22:26:58Z","modified":"2026-06-26T10:27:46Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"SUSE-SU-2018:4296-1","title":"Security update for mailman","description":"This update for mailman fixes the following security vulnerabilities:\n\n- Fixed a XSS vulnerability and information leak in user options CGI, which\n  could be used to execute arbitrary scripts in the user's browser via\n  specially encoded URLs (bsc#1077358 CVE-2018-5950)\n- Fixed a directory traversal vulnerability in MTA transports when using the\n  recommended Mailman Transport for Exim (bsc#925502 CVE-2015-2775)\n- Fixed a XSS vulnerability, which allowed malicious listowners to inject\n  scripts into the listinfo pages (bsc#1099510 CVE-2018-0618)\n- Fixed arbitrary text injection vulnerability in several mailman CGIs\n  (CVE-2018-13796 bsc#1101288)\n- Fixed a CSRF vulnerability on the user options page (CVE-2016-6893 bsc#995352)\n","status":"published","published":"2018-12-28T17:38:42Z","modified":"2026-02-04T03:28:59.775999Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:13924-1","title":"Security update for mailman","description":"This update for mailman fixes the following issues:\n\n- Fixed a XSS vulnerability and information leak in user options CGI, which\n  could be used to execute arbitrary scripts in the user's browser via\n  specially encoded URLs (bsc#1077358 CVE-2018-5950)\n- Fixed a directory traversal vulnerability in MTA transports when using the\n  recommended Mailman Transport for Exim (bsc#925502 CVE-2015-2775)\n- Fixed a XSS vulnerability, which allowed malicious listowners to inject\n  scripts into the listinfo pages (bsc#1099510 CVE-2018-0618)\n- Fixed arbitrary text injection vulnerability in several mailman CGIs\n  (CVE-2018-13796 bsc#1101288)\n- Fixed a CSRF vulnerability on the user options page (CVE-2016-6893 bsc#995352)\n","status":"published","published":"2019-01-04T10:03:11Z","modified":"2026-02-04T03:53:39.272307Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"UBUNTU-CVE-2015-2775","description":"Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.","status":"published","published":"2015-04-01T00:00:00Z","modified":"2026-02-04T03:14:41.349346Z","updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"USN-2558-1","title":"mailman vulnerability","description":"It was discovered that Mailman incorrectly handled special characters\nin list names. A local attacker could use this issue to perform a path\ntraversal attack and execute arbitrary code as the Mailman user.\n","status":"published","published":"2015-04-07T15:45:00Z","modified":"2026-02-10T04:40:53Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}