IPFire vulnerabilities

2 known vulnerabilities in IPFire from IPFire.org. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  IPFire: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-34312Oct 28, 2025IPFire.orgEPSS 2.24%

  IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the 'nobody' user via the BE_NAME parameter when installing a blacklist. When a blacklist is instal

• 8.8 High severity

  IPFire: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-34311Oct 28, 2025IPFire.orgEPSS 13.5%

  IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the user 'nobody' via multiple parameters when creating a Proxy report. When a user creates a Proxy