https://security-tracker.debian.org/tracker/CVE-2025-63261

Two-argument open() runs a command when the path ends in "|". Upstream is
retired and has no fix, so this is the patch Debian carries in awstats 8.0-5.

--- a/wwwroot/cgi-bin/awstats.pl
+++ b/wwwroot/cgi-bin/awstats.pl
@@ -7797,7 +7797,7 @@ sub Read_DNS_Cache {
 		LoadCache_hashfiles( $filetoload, $hashtoload );
 	}
 	if ( !scalar keys %$hashtoload ) {
-		open( DNSFILE, "$filetoload" )
+		open( DNSFILE, "<", "$filetoload" )
 		  or error("Couldn't open DNS Cache file \"$filetoload\": $!");
 
 #binmode DNSFILE;		# If we set binmode here, it seems that the load is broken on ActiveState 5.8