GNU Mailman Directory Traversal Vulnerability in cPanel and WHM

A directory traversal vulnerability has been identified in GNU Mailman version 2.1.39, which is included with cPanel and WHM. This vulnerability allows unauthenticated attackers to read arbitrary files by exploiting the private archive authentication endpoint. The issue arises from the username parameter, which can be manipulated to traverse directories and access restricted files.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server.