CVE-2025-34073 — stamparm/maltrail <=0.54 Remote Command Execution
An unauthenticated command injection vulnerability exists in stamparm/maltrail (Maltrail) versions <=0.54. A remote attacker can execute arbitrary operating system commands via …
Published: 2025-07-02 · CVSS: 10.0 · CVSS 4.0
An unauthenticated command injection vulnerability exists in stamparm/maltrail (Maltrail) versions <=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint. This occurs due to unsafe handling of user-supplied input passed to subprocess.check_output() in core/http.py, allowing injection of shell metacharacters. Exploitation does not require authentication and commands are executed with the privileges of the Maltrail process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7