Server-side software vulnerabilities can raise serious concerns for hosting providers and system administrators, especially when the affected component is integrated into a widely used hosting platform. One such issue is PTT-2025-021, a vulnerability identified in AWStats that can lead to arbitrary command execution under certain conditions.
The vulnerability is also tracked as CVE-2025-63261 and has been associated with unsafe use of Perl’s open functionality in AWStats. Security researchers from Pentest-Tools.com reported the issue, while cPanel subsequently released an update addressing the affected AWStats package.
For cPanel administrators, however, there is an important distinction: cPanel has stated that its software is not affected in the manner described by the vulnerability, because AWStats runs with the cPanel account’s system-user privileges rather than as root.
What Is PTT-2025-021?
PTT-2025-021 refers to a code-execution vulnerability discovered in AWStats, a web-based log-analysis application commonly used to generate website traffic statistics.
The vulnerability involves the way AWStats processes certain file names when handling DNS cache files. According to the security research, an attacker who can modify the relevant awstats.conf configuration and create files with specially crafted names may be able to cause arbitrary commands to execute.
The issue has been classified as CWE-78, OS Command Injection, and is identified by MITRE as CVE-2025-63261. The published research initially rated the vulnerability as high severity in environments where the necessary conditions for exploitation exist.
How Does the Vulnerability Work?
At a high level, the problem is related to unsafe handling of input by AWStats.
AWStats uses Perl to process information associated with statistics and configuration files. In the vulnerable code path, specially crafted content can influence how the Perl open function interprets a file name.
The important security concern is that Perl’s open can have special behavior when certain characters are present in an argument. If an attacker can control the relevant configuration and file name, that behavior can potentially result in operating-system command execution.
Exploitation is not simply a matter of visiting an AWStats page. The research indicates that an attacker needs specific capabilities, including the ability to modify awstats.conf and create appropriately named files on the system.
That distinction is important when assessing the actual risk to a particular server.
Is cPanel Vulnerable?
This is where cPanel administrators should pay close attention.
According to cPanel’s official advisory, cPanel software is not affected by this vulnerability in the security-impact scenario described for AWStats. cPanel explains that AWStats runs as the account’s system user instead of the root user.
This significantly limits the potential impact on a cPanel server because successful command execution through AWStats would occur with the privileges of the affected hosting account rather than with root-level privileges.
This does not mean administrators should ignore the vulnerability. Keeping third-party software updated remains an important part of server security.
cPanel Released an AWStats Update
cPanel addressed the issue by updating its AWStats package. The cPanel advisory lists the following versions as containing the security update:
cPanel & WHM 132.0.4
cPanel & WHM 130.0.16
cPanel & WHM 126.0.37
cPanel & WHM 110.0.80
cPanel states that if the server has been updated to one of these versions or a later version, no additional action is required for this particular issue.
The cPanel changelogs also identify the fix as an update to the AWStats package addressing CWE-78/PTT-2025-021.
How Should Server Administrators Respond?
Check the installed cPanel version and compare it with the versions containing the fix. If your server is running an older release, follow the normal cPanel update process and bring the system to a supported version.
Administrators should also avoid unnecessary manual modifications to AWStats configuration files. Custom changes can make it more difficult to determine whether a server is operating with the expected configuration.
After updating, review the server’s security and application logs if you have concerns about previous activity involving AWStats.
Should You Disable AWStats?
For most cPanel environments, disabling AWStats solely because of PTT-2025-021 should not be necessary if the server has received the relevant cPanel update.
If AWStats is not required in your environment, administrators can evaluate whether it should remain enabled as part of their normal server-hardening strategy.
Why Regular Updates Matter
PTT-2025-021 is a good example of why server security involves more than monitoring the operating system alone.
Hosting platforms contain many components, including web servers, scripting languages, mail systems, statistics applications, databases, and supporting libraries. A vulnerability in any one of these components can require an update.
Conclusion
PTT-2025-021 (CVE-2025-63261) is an AWStats command-execution vulnerability caused by unsafe handling of input in a Perl open operation. Exploitation requires specific privileges and conditions, including the ability to modify the relevant AWStats configuration and create files with controlled names.
For cPanel users, the situation is less difficult than the vulnerability description might initially suggest. cPanel has confirmed that its implementation is not affected in the stated root-level scenario because AWStats operates as the account’s system user. Nevertheless, cPanel released an AWStats package update to improve security.
Facing issues?
Our technical support
engineers can solve it.
