Back Linuxsecurity

Fedora 42 awstats Arbitrary Code Execution Fix CVE-2025

Linuxsecurity •LinuxSecurity Advisories • April 20, 2026

Advanced Web Statistics is a powerful and full-featured tool that generates advanced web server graphical statistics. This server log analyzer works from the command line or as a CGI and shows all information your log contains, in graphical web pages. It can analyze a lot of web/wap/proxy servers such as Apache, IIS, Weblogic, Webstar, Squid, ... but also mail or FTP servers. This program can measure visits, unique visitors, authenticated users, pages, domains/countries, OS busiest times, robot visits, type of files, engines/keywords used, visit duration, HTTP errors and more... Statistics can be updated from a browser or your scheduler. The program also supports virtual servers, plugins and a lot of features. With the default configuration, the statistics are available at: Update Information : Fix CVE-2025-63261 (rhbz #2450261)

Advanced Web Statistics is a powerful and full-featured tool that generates

advanced web server graphical statistics. This server log analyzer works

from the command line or as a CGI and shows all information your log contains,

in graphical web pages. It can analyze a lot of web/wap/proxy servers such as

Apache, IIS, Weblogic, Webstar, Squid, ... but also mail or FTP servers.

This program can measure visits, unique visitors, authenticated users, pages,

domains/countries, OS busiest times, robot visits, type of files,

engines/keywords used, visit duration, HTTP errors and more...

Statistics can be updated from a browser or your scheduler.

The program also supports virtual servers, plugins and a lot of features.

With the default configuration, the statistics are available at:

Fix CVE-2025-63261 (rhbz #2450261)

* Fri Apr 10 2026 Tim Jackson - 8.0-1 - Fix CVE-2025-63261 (rhbz #2450261)

[ 1 ] Bug #2450261 - CVE-2025-63261 awstats: AWStats: Arbitrary code execution via command injection vulnerability [fedora-42]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-29b65f46e8' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Arbitrary Code Execution Vulnerability in AWStats Fixed for Fedora 42 and 43 A critical vulnerability (CVE-2025-63261) affecting AWStats, a web server log analyzer, was published on March 20, 2026. This vulnerability allows for arbitrary code execution via command injection, impacting users of Fedora 42 and Fedora 43. The flaw was addressed in updates released on April 10, 2026, with Fedora 42 receiving version 8.0-1 and Fedora 43 receiving version 8.0-2. Users are advised to update their systems using the 'dnf' package manager to mitigate the risk. The vulnerability affects various web server environments, including Apache and IIS, and can allow attackers to execute arbitrary commands on the server. The updates are crucial for maintaining the security of systems using AWStats. The scope of impact includes any installations of AWStats on the specified Fedora versions. 2 sources 71

Extracted Entities

Fedora 42 awstats Arbitrary Code Execution Fix CVE-2025

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (5)