PT-2025-44160 · Ipfire · Ipfire

Alex Williams · Published 2025-10-28 · Updated 2025-10-28 · CVE-2025-34301

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IPFire versions prior to 2.29 (Core Update 198)

Description IPFire is affected by a stored cross-site scripting (XSS) issue. An authenticated attacker can inject arbitrary JavaScript code into the COUNTRY CODE parameter when creating a location group. The application issues an HTTP POST request with the ACTION parameter set to savelocationgrp. The value of the COUNTRY CODE parameter is stored and rendered in the web interface without proper sanitization, enabling the execution of malicious scripts in the context of other users.

Recommendations Update to version 2.29 (Core Update 198) or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-34301

Affected Products

Ipfire

References · 6

• https://osv.dev/vulnerability/CVE-2025-34301 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34301 · Security Note
• https://twitter.com/CVEnew/status/1983185718219272214 · Twitter Post
• https://bugzilla.ipfire.org/show_bug.cgi?id=13876 · Note
• https://ipfire.org/blog/ipfire-2-29-core-update-198-released · Patch, Vendor Advisory
• https://vulncheck.com/advisories/ipfire-stored-xss-via-location-group-creation · Note