CVE-2025-34073: Stamparm Maltrail

Critical severity, CVSS 10.0. EPSS: 5.5% chance of exploitation in the next 30 days.

An unauthenticated command injection vulnerability exists in stamparm/maltrail (Maltrail) versions <=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint. This occurs due to unsafe handling of user-supplied input passed to subprocess.check_output() in core/http.py, allowing injection of shell metacharacters. Exploitation does not require authentication and commands are executed with the privileges of the Maltrail process.

Affected products

• Stamparm Maltrail: up to and including 0.54

Published 2025-07-02. Last modified 2026-06-17.