CVE-2025-34073 Details
Description
An unauthenticated command injection vulnerability exists in stamparm/maltrail (Maltrail) versions <=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint. This occurs due to unsafe handling of user-supplied input passed to subprocess.check_output() in core/http.py, allowing injection of shell metacharacters. Exploitation does not require authentication and commands are executed with the privileges of the Maltrail process.
A command injection vulnerability allowing unauthenticated remote code execution exists in stamparm Maltrail versions through 0.54. The issue arises from improper handling of user input in the username parameter of POST requests to the /login endpoint. This vulnerability allows attackers to inject arbitrary operating system commands, which are executed with the same privileges as the Maltrail process.
Users can update to Maltrail version 0.55 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 2, 2025CISA-ADP
Assessed Jul 2, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/stamparm/maltrail | [email protected] | ProductVendor |
| https://github.com/stamparm/maltrail/issues/19146 | [email protected] | Issue TrackingVendor |
| https://huntr.com/bounties/be3c5204-fbd9-448d-b97c-96a8d2941e87 | [email protected] | ExploitTechnical Description |
| https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/http/maltrail_rce.rb | [email protected] | Exploit |
| https://vulncheck.com/advisories/stamparm-maltrail-rce | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| stamparm/maltrail | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 2, 2025 | New CVE Received | [email protected] |