This vulnerability (CVE-2025-34073) affects Stamparm Maltrail (<=0.54) and is caused by improper neutralization of special elements in user input (username parameter) used in an OS command context. Specifically, the username parameter in a POST request to /login is passed unsafely to subprocess.check_output(), allowing injection of shell metacharacters and arbitrary command execution. The flaw requires no authentication and results in command execution with the same privileges as the Maltrail process, representing a critical security risk. The CVSS 4.0 base score is 10.0, reflecting its critical severity and ease of exploitation.

Successful exploitation allows a remote unauthenticated attacker to execute arbitrary operating system commands on the host running Maltrail, with the same privileges as the Maltrail process. This can lead to full system compromise depending on the privileges of the Maltrail service. The vulnerability is critical due to its unauthenticated remote code execution nature and high CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the Maltrail /login endpoint to trusted networks only and monitor for suspicious POST requests targeting the username parameter. Avoid exposing Maltrail instances directly to untrusted networks. Follow the vendor's updates closely for an official patch or mitigation instructions.