CVE-2025-50974 – IPFire Calamaris Log Exporter Remote Code Execution

CVE ID : CVE-2025-50974

Published : Aug. 26, 2025, 5:15 p.m. | 1 hour, 21 minutes ago

Description : The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) in IPFire 2.29 does not properly sanitize user-supplied input before incorporating parameter values into a shell command. An unauthenticated remote attacker can inject arbitrary OS commands by embedding shell metacharacters in any of the following parameters BYTE_UNIT, DAY_BEGIN, DAY_END, HIST_LEVEL, MONTH_BEGIN, MONTH_END, NUM_CONTENT, NUM_DOMAINS, NUM_HOSTS, NUM_URLS, PERF_INTERVAL, YEAR_BEGIN, YEAR_END.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…