{"id":"CVE-2025-63261","aliases":["DEBIAN-CVE-2025-63261","DLA-4509-1","EUVD-2025-208911","GHSA-f93m-5ch9-5cqf","MGASA-2026-0138","UBUNTU-CVE-2025-63261"],"status":"published","title":"AWStats 8.0 is vulnerable to Command Injection via the open function","description":"AWStats 8.0 is vulnerable to Command Injection via the open function","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.01111,"percentile":0.66173,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2026-03-20T00:00:00Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"Debian:12","package":"awstats","fixed_in":["7.8-3+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"awstats","fixed_in":["7.9-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"awstats","fixed_in":["8.0-5"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"awstats","fixed_in":["7.8-2+deb11u2"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"awstats","fixed_in":["7.9-1.1.mga9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8-3+deb12u2"}]}],"versions":["7.8-3","7.8-3+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9-1+deb13u1"}]}],"versions":["7.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-5"}]}],"versions":["7.9-1","8.0-1","8.0-2","8.0-3","8.0-4"]},{"source":"osv","ecosystem":"Debian:11","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8-2+deb11u2"}]}],"versions":["7.8-2","7.8-2+deb11u1"]},{"source":"osv","ecosystem":"Mageia:9","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9-1.1.mga9"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.4+dfsg-1","7.4+dfsg-1ubuntu0.1","7.4+dfsg-1ubuntu0.2","7.4+dfsg-1ubuntu0.3","7.4+dfsg-1ubuntu0.4+esm1","7.4+dfsg-1ubuntu0.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.6+dfsg-1","7.6+dfsg-1ubuntu2","7.6+dfsg-2","7.6+dfsg-2ubuntu0.18.04.1","7.6+dfsg-2ubuntu0.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.6+dfsg-2","7.6+dfsg-2ubuntu0.20.04.1","7.6+dfsg-2ubuntu0.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.8-2","7.8-2ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.8-3","7.9-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.9-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0-4","8.0-5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.9-1","8.0-3","8.0-3build1","8.0-4"]}],"products":[{"vendor":"awstats","product":"awstats"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"https://github.com/eldy/AWStats/blob/develop/wwwroot/cgi-bin/awstats.pl","tags":["Product","web","report"]},{"url":"https://pentest-tools.com/PTT-2025-021-Code-Execution-in-AWStats.pdf","tags":["Exploit","Third Party Advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/03/msg00013.html","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-63261","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f93m-5ch9-5cqf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/63xxx/CVE-2025-63261.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-63261","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0138.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35407","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GP4DGW2LGHINXKYPZWR2WJ5DMROGGO66/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-63261","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-63261","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-63261","description":"AWStats 8.0 is vulnerable to Command Injection via the open function","status":"published","published":"2026-03-20T00:00:00Z","modified":"2026-03-25T22:10:36.546Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:32:45.503988Z"}],"euvd":[{"id":"EUVD-2025-208911","description":"AWStats 8.0 is vulnerable to Command Injection via the open function","status":"published","published":"2026-03-20T00:00:00Z","modified":"2026-03-25T22:10:36Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:25:28.569748Z"}],"ghsa":[{"id":"GHSA-f93m-5ch9-5cqf","title":"AWStats 8.0 is vulnerable to Command Injection via the open function","description":"AWStats 8.0 is vulnerable to Command Injection via the open function","status":"published","published":"2026-03-20T21:31:28Z","modified":"2026-03-26T00:30:54Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:06:52.37988Z"}],"nvd":[{"id":"CVE-2025-63261","description":"AWStats 8.0 is vulnerable to Command Injection via the open function","status":"published","published":"2026-03-20T21:17:12.8Z","modified":"2026-06-17T09:53:00.527Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:01.641503Z"}],"osv":[{"id":"CVE-2025-63261","description":"AWStats 8.0 is vulnerable to Command Injection via the open function","status":"published","published":"2026-03-20T00:00:00Z","modified":"2026-10-28T02:31:09.703242878Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:51.851511Z"},{"id":"DEBIAN-CVE-2025-63261","description":"AWStats 8.0 is vulnerable to Command Injection via the open function","status":"published","published":"2026-03-20T21:17:12.8Z","modified":"2026-09-01T20:04:29.193355091Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"UBUNTU-CVE-2025-63261","description":"AWStats 8.0 is vulnerable to Command Injection via the open function","status":"published","published":"2026-03-20T21:17:00Z","modified":"2026-10-17T12:57:29.028542912Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"DLA-4509-1","title":"awstats - security update","status":"published","published":"2026-03-25T00:00:00Z","modified":"2026-03-25T21:01:14.68415Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2026-0138","title":"Updated awstats packages fix security vulnerability","description":"AWStats is vulnerable to Command Injection via the open function.\n(CVE-2025-63261)\n","status":"published","published":"2026-05-15T06:17:07Z","modified":"2026-05-15T06:30:10.323369Z","updated_at":"2026-11-02T15:49:43.178336Z"}]}}