# CVE-2025-34030: Sar2html - RCE

> Live exploitation tracking for CVE-2025-34030 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-34030

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** Sar2html
- **Weaknesses:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
- **Tags:** web_application

## Description

An OS command injection vulnerability exists in Sar2html version 3.2.2 and prior via the plot parameter in index.php. The application fails to sanitize user-supplied input before using it in a system-level context. Remote, unauthenticated attackers can inject shell commands by appending them to the plot parameter (e.g., ?plot=;id) in a crafted GET request. The output of the command is displayed in the application's interface after interacting with the host selection UI. Successful exploitation leads to arbitrary command execution on the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-04 UTC.

## CrowdSec analysis

[CVE-2025-34030](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-34030) is a critical OS command injection vulnerability in Sar2html versions 3.2.2 and earlier, allowing remote, unauthenticated attackers to execute arbitrary system commands via the plot parameter in index.php. By crafting malicious GET requests, attackers can gain full control over the underlying server, potentially leading to data theft, system compromise, or further lateral movement within the network. This vulnerability has been actively exploited in the wild, making immediate remediation essential for affected systems.

CrowdSec has been tracking this vulnerability and its exploits since 3rd of June 2026.

Data from the CrowdSec community indicates that exploitation of CVE-2025-34030 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-34030 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit the `plot` parameter in requests to `/index.php` by injecting shell metacharacters (such as `;`) to execute arbitrary OS commands, enabling remote code execution on vulnerable Sar2html instances.

## Timeline

- 2025-06-20: CVE Published. CVE-2025-34030 is published to NVD.
- 2026-06-03: Rule Released. CrowdSec releases a rule to detect CVE-2025-34030 exploitation attempts against the CrowdSec Network.
- 2026-06-06: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-34030 for the first time.

## References

- https://github.com/cemtan/sar2html
- https://www.fortiguard.com/encyclopedia/ips/48624
- https://vulncheck.com/advisories/sar2html-command-injection
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34030.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-34030) follows observed exploitation activity for CVE-2025-34030. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.