This vulnerability in IPFire's 'proxy.cgi' interface allows an authenticated user to perform OS command injection by supplying specially crafted input in the NCSA user creation form fields. The flaw is due to improper sanitization of input that is passed to shell commands, enabling execution of arbitrary commands with web server privileges. It affects all versions prior to 2.19 Core Update 101. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no user interaction, and privileges required but no scope change.

Successful exploitation allows an authenticated attacker to execute arbitrary shell commands on the IPFire system with the privileges of the web server process. This can lead to full compromise of the affected system depending on the web server's permissions. The vulnerability does not require user interaction but does require authentication. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 2.19 Core Update 101, upgrading to version 2.19 Core Update 101 or later is likely the intended remediation once officially released. Until then, restrict access to the 'proxy.cgi' interface to trusted authenticated users only and monitor for suspicious activity related to user creation forms.