CVE-2025-34116

High

Description

A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authenticated attacker can inject arbitrary shell commands through crafted values in the NCSA user creation form fields, leading to command execution with web server privileges.

SeverityHigh

CVSS8.7

Exploit probability—

ProductIPFire

PublishedJul 15, 2025

First seenJul 15, 2025

Weakness typeCWE-78OS command injection CWE-20Improper input validation CWE-306Missing authentication for critical function

How to fix

Update

IPFire Project IPFire2.19 Core Update 101 or later

Patches

ipfire.org/news/ipfire-2-19-core-update-101-released

Affected products

Product	Affected versions	Fixed in
IPFire Project IPFire	v < 2.19 Core Update 101	2.19 Core Update 101

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.