RCE in Stamparm Maltrail
CVE-2025-34073
An unauthenticated command injection vulnerability exists in stamparm/maltrail (Maltrail) versions <=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint. This occurs due to unsafe handling of user-supplied input passed to subprocess.check_output() in core/http.py, allowing injection of shell metacharacters. Exploitation does not require authentication and commands are executed with the privileges of the Maltrail process.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
EPSS exploit prediction
EPSS: 0.055 (92.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 93rd percentile — 92.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.057 · newest: 0.055 · change: -0.002
Affected products
- Stamparm Maltrail — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/u… (exploit)
- huntr.com/bounties/be3c5204-fbd9-448d-b97c-96a8d2941e87 (exploit, third-party-advisory)
- github.com/stamparm/maltrail (product)
- github.com/stamparm/maltrail/issues/19146 (issue-tracking)
- vulncheck.com/advisories/stamparm-maltrail-rce (third-party-advisory)
Frequently asked questions
- What is CVE-2025-34073?
- CVE-2025-34073 is a vulnerability in Stamparm Maltrail, classified under OS Command Injection. Published 2025-07-02.
- Is CVE-2025-34073 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.