by Kastro
Paper/Archive/CVE-2025-34073

CVE-2025-34073

Stamparm Maltrail — stamparm/maltrail <=0.54 Remote Command Execution

EPSS 5%public exploitCVSS 10.0
critical.is priorityof 100
59
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 92.8.928 × 2018.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An unauthenticated command injection vulnerability exists in stamparm/maltrail (Maltrail) versions <=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint. This occurs due to unsafe handling of user-supplied input passed to subprocess.check_output() in core/http.py, allowing injection of shell metacharacters. Exploitation does not require authentication and commands are executed with the privileges of the Maltrail process.

Affected

ProductAffectedFixed inSource
Maltrail≤ 0.54–CNA

Scores by source

VulnCheck (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitraw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/http/maltrail_rce.rbexploithuntr.com/bounties/be3c5204-fbd9-448d-b97c-96a8d2941e87refgithub.com/stamparm/maltrailrefgithub.com/stamparm/maltrail/issues/19146writeupvulncheck.com/advisories/stamparm-maltrail-rce