CVE-2025-34301 Details
Description
IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code into the COUNTRY_CODE parameter when creating a location group. When a user adds a new location group, the application issues an HTTP POST request with the ACTION parameter set to savelocationgrp, and the value of the COUNTRY_CODE parameter determines the flag displayed for that group. The value of this parameter is stored and later rendered in the web interface without proper sanitization or encoding, allowing malicious scripts to be executed in the context of other users viewing the affected page.
A stored cross-site scripting vulnerability has been identified in IPFire versions prior to 2.29 (Core Update 198). This vulnerability allows authenticated attackers to inject arbitrary JavaScript into the COUNTRY_CODE parameter while creating location groups. The injected code is stored and later executed in the context of users viewing the affected page, due to improper sanitization of the COUNTRY_CODE value, which determines the flag displayed for the location group.
Users can update to IPFire 2.29 (Core Update 198) to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 28, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugzilla.ipfire.org/show_bug.cgi?id=13876 | [email protected] | Issue TrackingThird Party Advisory |
| https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released | [email protected] | Release Notes |
| https://www.vulncheck.com/advisories/ipfire-stored-xss-via-location-group-creation | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ipfire ipfire | < 2.29 2.29 core_update183 2.29 core_update184 2.29 core_update185 2.29 core_update186 2.29 core_update187 2.29 core_update188 2.29 core_update189 2.29 core_update190 2.29 core_update191 2.29 core_update192 2.29 core_update193 2.29 core_update194 2.29 core_update195 2.29 core_update196 2.29 core_update197 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2025 | Initial Analysis | [email protected] |
| Oct 28, 2025 | New CVE Received | [email protected] |