RCE in Ipfire

CVE-2025-34311

IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the user 'nobody' via multiple parameters when creating a Proxy report. When a user creates a Proxy report the application issues an HTTP POST to /cgi-bin/logs.cgi/calamaris.dat and reads the values of DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, DAY_END, MONTH_END, YEAR_END, NUM_DOMAINS, PERF_INTERVAL, NUM_CONTENT, HIST_LEVEL, NUM_HOSTS, NUM_URLS, and BYTE_UNIT, which are interpolated directly into the shell invocation of the mkreport helper. Because these parameters are never sanitized for improper characters or constructs, a crafted POST can inject shell metacharacters into one or more fields, causing arbitrary commands to run with the privileges of the 'nobody' user.

Vulnerability class: Command Injection (OS Command Injection)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.135 (96.3th percentile), scored .

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 96.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2025-34311: held from 0.138 to 0.135.

EPSS over last 30 days · oldest: 0.138 · newest: 0.135 · change: -0.003

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2025-34311?
CVE-2025-34311 is a high-severity vulnerability in Ipfire, classified under OS Command Injection. CVSS score: 8.8/10. Published 2025-10-28.
How severe is CVE-2025-34311?
High severity. CVSS v3 base score is 8.8 out of 10.