This vulnerability (CVE-2025-34116) in the IPFire project arises from improper neutralization of special elements used in OS commands (CWE-78) within the 'proxy.cgi' interface. Authenticated users submitting crafted values in the NCSA user creation form can execute arbitrary shell commands with web server privileges. The vulnerability is present in IPFire versions before 2.19 Core Update 101. The CVSS 4.0 base score is 8.7, indicating high severity, with network attack vector, low attack complexity, no user interaction required, and privileges required. The vulnerability also involves weaknesses related to input validation (CWE-20) and insufficient authentication (CWE-306). No patch or official remediation details are provided in the available data.

An authenticated attacker can achieve remote command execution on the affected IPFire system with web server privileges. This could allow the attacker to execute arbitrary commands, potentially compromising the system integrity and confidentiality. The vulnerability does not require user interaction and can be exploited remotely over the network. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or update link is provided, users should monitor IPFire Project communications for an official fix. Until then, restrict access to the 'proxy.cgi' interface to trusted users only and ensure strong authentication controls to limit exploitation potential.