Vulnerability in AWStats (Details via private mail)

[untested711]

Hi @eldy,

Sent you a mail (to eldy@destailleur.fr) on Aug 4, 2025 regarding a vulnerability in AWStats.

Please confirm you have received it via mail.

Thanks

[eldy]

I have received email with reminder but no description on vulnerability, but i may have missed it.

[untested711]

Resent the initial mail.

Please check the Spam folder or if the mail was blocked.

The first and third mail may not have reached because we are trying to send the PoC as an attachment.

Please let us know asap if you received it or, if not, in order for us to resend the whole PoC as plaintext.

Thanks

[dualfade]

please watch for other emails in spam as well.

Thank you.

[ShaiMagal]

@untested711 Can you send me more details please?

[dualfade]

I also sent over a vuln last week around same time. So please watch for that in spam. It may be something else entirely. If so; I would like to open a valid request for it. As there are very minimal details here.

POC was included.

Thanks.

[hannob]

Was this referring to this (now public) vulnerability?
https://www.openwall.com/lists/oss-security/2026/03/08/8

[dualfade]

Yes. That is the post. I know this is now deprecated. But quite a bit of folks are still using it. They should be aware.

Thanks !

[vkarlsen]

The Files section in README.md doesn't mention awdownloadcsv.pl among the files that are (or are supposed to be?) included in the distribution.
Perhaps the file should be deleted altogether?

[hannob]

If the file is to be obsoleted, please don't just remove it, but replace it with a dummy version.
It's a very common pattern to update simple CGI web applications by copying the new version over the old one. If the file is simply removed, the old version may stay in many setups.