CVE-2025-63261 - AWStats 8.0 is vulnerable to Command Injection via the open function · CoreCVE

Back Back to CVE browser

HIGH

AWStats 8.0 is vulnerable to Command Injection via the open function

Published Mar 20, 2026

7.8

HIGH

CVSS 3.1

EPSS 1.05%

Description

AWStats 8.0 is vulnerable to Command Injection via the open function

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-208911
Advisory
https://github.com/eldy/AWStats/blob/develop/wwwroot/cgi-bin/awstats.pl
Product
https://lists.debian.org/debian-lts-announce/2026/03/msg00013.html
Mailing ListThird Party Advisory
https://pentest-tools.com/PTT-2025-021-Code-Execution-in-AWStats.pdf
ExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-208911		Advisory
https://github.com/eldy/AWStats/blob/develop/wwwroot/cgi-bin/awstats.pl		Product
https://lists.debian.org/debian-lts-announce/2026/03/msg00013.html		Mailing ListThird Party Advisory
https://pentest-tools.com/PTT-2025-021-Code-Execution-in-AWStats.pdf		ExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Mar 20, 2026

Updated Mar 25, 2026

Reserved Oct 27, 2025

Link CVE-2025-63261

CISA Vulnrichment

Updated Mar 23, 2026

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-63261

Severity n/a

Public date n/a

Links CVE-2025-63261

Assigner mitre

Published Mar 20, 2026

Updated Mar 25, 2026

Exploited since n/a

Link EUVD-2025-208911

EUVD-2025-208911