CVE-2025-34073

EIP tracks 1 public exploit for CVE-2025-34073. Includes Metasploit module exploits/unix/http/maltrail_rce. A Nuclei detection template is also available.

AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in Maltrail versions <= 0.54 via the `username` parameter in the login endpoint. It allows unauthenticated remote code execution by injecting commands into the `subprocess.check_output` function.

An unauthenticated command injection vulnerability exists in stamparm/maltrail (Maltrail) versions <=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint. This occurs due to unsafe handling of user-supplied input passed to subprocess.check_output() in core/http.py, allowing injection of shell metacharacters. Exploitation does not require authentication and commands are executed with the privileges of the Maltrail process.