CVE-2025-34116
A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authenticated attacker can inject arbitrary shell commands through crafted values in the NCSA user creation form fields, leading to command execution with web server privileges.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 1.67%
- CWE
- CWE-78, CWE-20, CWE-306
- Published
- 2025-07-15
- Last modified
- 2026-05-15
Affected products
- IPFire Project IPFire
- IPFire Project IPFire
Weakness type
Related vulnerabilities
- CVE-2026-78569 — Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- CVE-2026-78575 — Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- CVE-2026-79724 — Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- CVE-2026-81550 — DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-82095 — DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-82098 — DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-82099 — DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-19136 — A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application,...