PT-2026-20501 · Ipfire · Ipfire

Ozer Goker · Published 2026-02-18 · Updated 2026-02-18 · CVE-2019-25399

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IPFire version 2.21 Core Update 127

Description The software contains multiple stored cross-site scripting issues in the extrahd.cgi script. Attackers can inject malicious scripts through the FS, PATH, and UUID parameters. By submitting POST requests with script payloads in these parameters, attackers can execute arbitrary JavaScript within authenticated administrator sessions. The vulnerable parameters are FS, PATH, and UUID. The affected API endpoint is extrahd.cgi.

Recommendations Apply updates to address the issue in IPFire version 2.21 Core Update 127.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25399

Affected Products

Ipfire

References · 6

• 🔥 https://exploit-db.com/exploits/46344 · Exploit
• https://downloads.ipfire.org/releases/ipfire-2.x/2.21-core127/ipfire-2.21.x86_64-full-core127.iso · Patch
• https://osv.dev/vulnerability/CVE-2019-25399 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25399 · Security Note
• https://vulncheck.com/advisories/ipfire-core-update-stored-xss-via-extrahdcgi · Note
• https://ipfire.org · Note