CVE-2025-34311: IPFire < v2.29 Command Injection via Proxy Report Creation

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-28 · updated 2026-09-26
Weakness: CWE-78

Description

IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the user 'nobody' via multiple parameters when creating a Proxy report. When a user creates a Proxy report the application issues an HTTP POST to /cgi-bin/logs.cgi/calamaris.dat and reads the values of DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, DAY_END, MONTH_END, YEAR_END, NUM_DOMAINS, PERF_INTERVAL, NUM_CONTENT, HIST_LEVEL, NUM_HOSTS, NUM_URLS, and BYTE_UNIT, which are interpolated directly into the shell invocation of the mkreport helper. Because these parameters are never sanitized for improper characters or constructs, a crafted POST can inject shell metacharacters into one or more fields, causing arbitrary commands to run with the privileges of the 'nobody' user.

Affected products

IPFire.org IPFire: before 2.29; 2.29-core_update183, 2.29-core_update184, 2.29-core_update185, 2.29-core_update186, 2.29-core_update187, 2.29-core_update188 (+9) — fixed in 2.29

How to fix

Upgrade to a fixed version: IPFire.org IPFire 2.29. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-34311 or the next vulnerability affects your stack