A vulnerability in AWStats 8.0 allows an attacker to inject arbitrary operating‑system commands through the open function used by the CGI script. This command injection, identified as CWE‑78, can lead to remote code execution on the web server hosting AWStats, granting full control over that system if exploitation is successful.

The flaw affects installations of AWStats version 8.0. Systems running this version on Debian 11.0 Linux, or any operating system where AWStats 8.0 is deployed, are at risk if the CGI interface is reachable from the network.

The CVSS score of 7.8 categorizes the issue as high severity, but the EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack path is through the publicly accessible AWStats CGI script; an attacker who can submit input that reaches the vulnerable open call can potentially execute arbitrary commands. No authentication requirement is stated in the description, so access controls around the CGI directory may influence the feasibility of exploitation.