ipfire vulnerabilities and fixes

Recent CVEs affecting ipfire, with upgrade or downgrade steps. 25 tracked.

ipfire has 25 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 17. Most recent: 2026-02-18. Highest priority: CVE-2025-34311 (score 55/100).

• CVE-2025-34301 MEDIUM 5.4 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that
• CVE-2025-34309 MEDIUM 5.4 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that
• CVE-2025-34304 MEDIUM 6.5 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain a SQL injection vulnerability that allows an authentic
• CVE-2025-34302 MEDIUM 5.4 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that
• CVE-2025-34303 MEDIUM 5.4 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that
• CVE-2025-34305 MEDIUM 5.4 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain multiple stored cross-site scripting (XSS) vulnerabili
• CVE-2025-34306 MEDIUM 5.4 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that
• CVE-2025-34307 MEDIUM 5.4 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that
• CVE-2025-34308 MEDIUM 5.4 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that
• CVE-2025-34310 MEDIUM 5.4 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that
• CVE-2025-34313 MEDIUM 5.4 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that
• CVE-2025-34314 MEDIUM 5.4 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that
• CVE-2025-34311 HIGH 8.8 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authe
• CVE-2025-34312 HIGH 8.8 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authe
• CVE-2025-34315 MEDIUM 5.4 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that
• CVE-2025-34316 MEDIUM 5.4 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that
• CVE-2025-50976 MEDIUM 6.1 DOWNGRADE IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVE
• CVE-2025-50975 MEDIUM 5.4 DOWNGRADE IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule parameters such as PROT
• CVE-2025-50974 MEDIUM 6.5 DOWNGRADE The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) in IPFire 2.29 does not properly sanitize use
• CVE-2025-34317 MEDIUM 5.4 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that
• CVE-2019-25400 MEDIUM 5.4 DOWNGRADE IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the fwhosts.cg
• CVE-2019-25399 MEDIUM 6.4 DOWNGRADE IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi s
• CVE-2019-25398 MEDIUM 6.1 DOWNGRADE IPFire 2.21 Core Update 127 contains multiple cross-site scripting vulnerabilities in the ovpnmain.cgi script
• CVE-2019-25397 MEDIUM 6.1 DOWNGRADE IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the hosts.cgi
• CVE-2019-25396 MEDIUM 6.1 DOWNGRADE IPFire 2.21 Core Update 127 contains a reflected cross-site scripting vulnerability in the updatexlrator.cgi s

FAQ

How do I fix ipfire vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is ipfire being exploited right now?

None of the tracked ipfire CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which ipfire CVE should I patch first?

CVE-2025-34311 currently ranks highest (55/100): IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authe.

RSS feed for ipfire · ← Back to latest CVEs