What’s Vulnerable › Vulnerabilities

CVE-2025-34116: IPFire < 2.19 Core Update 101 proxy.cgi RCE

• Severity: high (CVSS 8.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-15 · updated 2026-06-17
• Weakness: CWE-20

Description

A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authenticated attacker can inject arbitrary shell commands through crafted values in the NCSA user creation form fields, leading to command execution with web server privileges.

Affected products

• IPFire.org IPFire: before 2.19 Core Update 101 — fixed in 2.19 Core Update 101

How to fix

Upgrade to a fixed version: IPFire.org IPFire 2.19 Core Update 101. Check the vendor advisory for mitigations.

References

• https://bugzilla.ipfire.org/show_bug.cgi?id=11087
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/ipfire_proxy_exec.rb
• https://www.asafety.fr/en/vuln-exploit-poc/xss-rce-ipfire-2-19-core-update-101-remote-command-execution/
• https://www.exploit-db.com/exploits/39765
• https://www.ipfire.org/news/ipfire-2-19-core-update-101-released
• https://www.vulncheck.com/advisories/ipfire-authenticated-rce

Get alerted when CVE-2025-34116 or the next vulnerability affects your stack