CVE-2025-63261: 
NixOS vulnerability analysis and mitigation

CVE-2025-63261 is a command injection vulnerability in AWStats 8.0 that allows a local attacker with low privileges to execute arbitrary operating system commands via the open function in the AWStats Perl script (awstats.pl). The vulnerability was first inserted into Feedly's tracking on January 9, 2026, and publicly disclosed on March 20, 2026. Affected software includes AWStats 8.0 (and version 7.9 per CPE data) and Debian Linux 11.0 distributions shipping the affected package. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Bugzilla, Feedly).

The root cause is improper neutralization of special elements used in OS commands (CWE-78) within AWStats's Perl open function call in awstats.pl. Exploitation requires an attacker to create or modify the awstats.conf configuration file — specifically the DNSLastUpdateCacheFile directive — with a malicious value that is subsequently passed unsanitized to the open function, triggering arbitrary command execution. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction, making it exploitable when a lower-privileged user can write to the configuration file that is later processed by a higher-privileged process (e.g., root or apache). A proof-of-concept technical write-up is publicly available (Pentest-Tools PoC, Red Hat Bugzilla, AWStats Source).

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the AWStats process (e.g., root or apache), resulting in high impact to confidentiality, integrity, and availability. An attacker could access sensitive data, modify or delete system files, install backdoors, or use the compromised host as a pivot point for lateral movement within the network. The vulnerability is particularly dangerous in configurations where AWStats runs as a privileged user and a lower-privileged user has write access to the configuration file (Red Hat Bugzilla, Feedly).

A public proof-of-concept exploit document is available from Pentest-Tools (PTT-2025-021), and the vulnerability has been detected by multiple scanners including Nessus (plugins 303267, 307513, 307515, 310437) and Qualys (6274990). There is no confirmed evidence of in-the-wild exploitation at this time, and the EPSS score is low at approximately 0.0015 (0.15%). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Pentest-Tools PoC, Feedly).

1. Reconnaissance: Identify systems running AWStats 8.0 or 7.9, particularly where the AWStats process runs as a privileged user (root or apache) and where a lower-privileged user has write access to awstats.conf.
2. Locate configuration file: Identify the path to the active awstats.conf file. Common locations include /etc/awstats/awstats.conf, /usr/local/awstats/wwwroot/cgi-bin/awstats.conf, or /usr/local/etc/awstats/awstats.conf.
3. Inject malicious payload: Modify the DNSLastUpdateCacheFile directive in awstats.conf to include a shell command injection payload. For example, set the value to a filename prefixed with a pipe character or other shell metacharacter that Perl's open function will interpret as a command (e.g., DNSLastUpdateCacheFile=|malicious_command|).
4. Trigger execution: Wait for or trigger AWStats to process the modified configuration file — this may occur via a scheduled cron job (e.g., /etc/cron.hourly/awstats) or by invoking the AWStats CGI script through a web interface.
5. Achieve code execution: The injected command executes with the privileges of the AWStats process, enabling the attacker to establish a reverse shell, exfiltrate data, or escalate privileges further (Pentest-Tools PoC, Red Hat Bugzilla).

• File System: Unexpected modifications to awstats.conf files, particularly changes to the DNSLastUpdateCacheFile directive containing shell metacharacters (e.g., |, ;, &); new or modified files in AWStats installation directories.
• Logs: AWStats cron job or CGI logs showing unexpected errors or output from the open function; system auth logs showing privilege escalation from the apache or awstats user.
• Process: Unusual child processes spawned by the AWStats Perl interpreter (e.g., /bin/sh, bash, curl, wget, nc) — especially during scheduled cron execution; unexpected network connections originating from the web server process.
• Network: Outbound connections from the web server host to unknown external IPs, particularly on non-standard ports, following AWStats cron execution times.

Patches have been released for multiple distributions: Fedora 44 (awstats-8.0-4.fc44, FEDORA-2026-649970e065), Fedora 42, Debian LTS (DLA-4509-1), and Mageia (MGASA-2026-0138). Users should update AWStats to the patched version available for their distribution immediately. As a workaround, restrict write access to awstats.conf so that only trusted, privileged users can modify it, and ensure AWStats does not run as root where possible. Monitor configuration files for unauthorized changes (Red Hat Bugzilla, Linux Security Debian, Linux Security Fedora).

Red Hat's Tim Jackson noted in the Bugzilla report that exploitation in the default Fedora/EPEL configuration is not straightforward, as the directories searched for awstats.conf are not writable by untrusted users by default, somewhat limiting the practical impact in standard deployments. The vulnerability was covered by Linux security news outlets including LinuxSecurity.com and Pro-Linux.de, and was tracked by multiple vulnerability intelligence platforms. No major vendor statements or significant social media controversy beyond standard security advisory coverage has been observed (Red Hat Bugzilla, Linux Security Debian).