CVE-2025-34073
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedAn unauthenticated command injection vulnerability exists in stamparm/maltrail (Maltrail) versions <=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint. This occurs due to unsafe handling of user-supplied input passed to subprocess.check_output() in core/http.py, allowing injection of shell metacharacters. Exploitation does not require authentication and commands are executed with the privileges of the Maltrail process.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceAn unauthenticated command injection vulnerability in Maltrail <=0.54 allows remote attackers to execute arbitrary OS commands via the username parameter in POST requests to /login. The vulnerability stems from unsafe handling of user-supplied input passed to subprocess.check_output() in core/http.py, enabling shell metacharacter injection without authentication.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- Authentication
- X
- User interaction
- None
- Scope
- X
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify Maltrail versionCheck the version file typically located at /opt/maltrail/README.md, or inspect the login page HTML for a version string, or run: grep -r 'version' /opt/maltrail/ | head -20Affected if Installed version is 0.54 or lower, or if no version is displayed (older unpatched build)
-
Locate the vulnerable code fileInspect the file core/http.py in the Maltrail installation directory and search for subprocess.check_output calls that handle the username parameter from /loginAffected if The file core/http.py exists and contains subprocess.check_output() calls using the username parameter without proper sanitization
-
Verify the /login endpoint is network-accessibleCheck if the Maltrail web interface port (default 8080) is exposed to untrusted networks; attempt a curl -X POST http://<target>/login with a test username parameterAffected if The /login endpoint is accessible from an untrusted network without authentication requirements
-
Confirm default authentication is disabledCheck maltrail.conf for AUTHENTICATION_DISABLED or similar settings, and verify if the login page accepts any username without a valid passwordAffected if Authentication is disabled (AUTHENTICATION_DISABLED=true in config) or the login form does not validate credentials before processing the username parameter
You are affected if Maltrail version is 0.54 or lower, the /login endpoint is network-accessible, and the vulnerable subprocess.check_output pattern in core/http.py processes the username parameter without input sanitization.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedImmediately upgrade Maltrail to a patched version >0.54. If immediate patching is not feasible, restrict network access to the /login endpoint using firewall rules or a WAF, and investigate the system for signs of compromise.
Maltrail version > 0.54 (latest stable release)
- Identify the current Maltrail version by checking the version file or running 'git log' to confirm version <= 0.54
- Upgrade Maltrail to the latest available release that is newer than version 0.54
- After upgrading, verify the fix by reviewing the core/http.py file to ensure subprocess.check_output() no longer uses unsanitized user input from the username parameter
- Restart the Maltrail service to apply the updated code
- Confirm the login functionality works correctly with the updated version
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation4.0 h
- Testing3.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,728.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-34073 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-34073 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data