CVE-2003-1426

CVE-2003-1426 describes a local arbitrary code execution vulnerability in Openwebmail, specifically when used with cPanel 5.0 and configured to run with suid Perl. The flaw allows a local attacker to manipulate the SCRIPT_FILENAME environment variable, causing Openwebmail to include a malicious script from an attacker-controlled directory. This vulnerability has a CVSS score of 3.3, indicating low severity, with an attack vector of local access and medium attack complexity. Successful exploitation could lead to partial confidentiality and integrity impact, allowing an attacker to execute arbitrary code on the affected system. There is no evidence of active exploitation, nor are there publicly available exploits in Metasploit, Nuclei, or ExploitDB. Despite its age and low severity, the CVE has garnered some community discussion, with 10 mentions, primarily on GitHub.