Maltrail versions <=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint.
id: CVE-2025-34073
info:
name: Maltrail <=0.54 Username Parameter - Remote Command Execution
a
...