CVE-2025-34073

🗓️ 02 Jul 2025 13:46:59Reported by VulnCheckType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 47 Views🌐 WEB

Unauthenticated command injection in Maltrail versions <=0.54 allows remote command execution.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-34073	16 Aug 202322:01	–	circl
CNNVD	maltrail 安全漏洞	2 Jul 202500:00	–	cnnvd
Cvelist	CVE-2025-34073 stamparm/maltrail <=0.54 Remote Command Execution	2 Jul 202513:46	–	cvelist
EUVD	EUVD-2025-19716	2 Jul 202513:46	–	euvd
Metasploit	Maltrail Unauthenticated Command Injection	17 Aug 202319:51	–	metasploit
Nuclei	Maltrail <=0.54 Username Parameter - Remote Command Execution	4 Feb 202607:00	–	nuclei
NVD	CVE-2025-34073	2 Jul 202514:15	–	nvd
OSV	CVE-2025-34073	2 Jul 202514:15	–	osv
Positive Technologies	PT-2025-27631	2 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-34073	4 Jul 202514:22	–	redhatcve

Vulners

Node

stamparm maltrailRange0–0.54

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "core/http.py – login request handler"
    ],
    "packageName": "maltrail",
    "packageURL": "pkg:github/stamparm/maltrail",
    "product": "Maltrail",
    "vendor": "Stamparm",
    "versions": [
      {
        "lessThanOrEqual": "0.54",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/stamparm/maltrail
raw	www.raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/http/maltrail_rce.rb
huntr	www.huntr.com/bounties/be3c5204-fbd9-448d-b97c-96a8d2941e87
vulncheck	www.vulncheck.com/advisories/stamparm-maltrail-rce
github	www.github.com/stamparm/maltrail/issues/19146

Parameter	Position	Path	Description	CWE
username	request body	/login	Unauthenticated command injection via the username parameter in the login endpoint.	CWE-306, CWE-78

14 May 2026 02:07Current

8.3High risk

Vulners AI Score8.3

CVSS 410

EPSS0.65833

SSVC