CVE-2025-54123

Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at `/api/v2/hoverfly/middleware` endpoint due to insufficient validation and sanitization in user input. The vulnerability exists in the middleware management API endpoint `/api/v2/hoverfly/middleware`. This issue is born due to combination of three code level flaws: Insufficient Input Validation in middleware.go line 94-96; Unsafe Command Execution in local_middleware.go line 14-19; and Immediate Execution During Testing in hoverfly_service.go line 173. This allows an attacker to gain remote code execution (RCE) on any system running the vulnerable Hoverfly service. Since the input is directly passed to system commands without proper checks, an attacker can upload a malicious payload or directly execute arbitrary commands (including reverse shells) on the host server with the privileges of the Hoverfly process. Commit 17e60a9bc78826deb4b782dca1c1abd3dbe60d40 in version 1.12.0 disables the set middleware API by default, and subsequent changes to documentation make users aware of the security changes of exposing the set middleware API.

• CWE-20
• CWE-78
• CWE-78

• https://github.com/SpectoLabs/hoverfly/blob/master/core/hoverfly_service.go#L173Product
• https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/local_middleware.go#L13Product
• https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/middleware.go#L93Product
• https://github.com/SpectoLabs/hoverfly/commit/17e60a9bc78826deb4b782dca1c1abd3dbe60d40Patch
• https://github.com/SpectoLabs/hoverfly/commit/a9d4da7bd7269651f54542ab790d0c613d568d3ePatch
• https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-r4h8-hfp2-ggmfExploit, Vendor Advisory
• https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-r4h8-hfp2-ggmfExploit, Vendor Advisory

Published

Sep 10, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-54118NamelessMC is a free, easy to use & powerful website softwar…5.3
• CVE-2025-54119ADOdb is a PHP database class library that provides abstract…10
• CVE-2025-5412A vulnerability classified as problematic has been found in …5.4
• CVE-2025-54120PCL (Plain Craft Launcher) Community Edition is a Minecraft …9.3
• CVE-2025-54121Starlette is a lightweight ASGI (Asynchronous Server Gateway…5.3
• CVE-2025-54122Manager-io/Manager is accounting software. A critical unauth…10
• CVE-2025-54124XWiki Platform is a generic wiki platform offering runtime s…6.5
• CVE-2025-54125XWiki Platform is a generic wiki platform offering runtime s…6.5
• CVE-2025-54126The WebAssembly Micro Runtime's (WAMR) iwasm package is the …5.3
• CVE-2025-54127HAXcms with nodejs backend allows users to start the server …9.8
• CVE-2025-54128HAX CMS NodeJs allows users to manage their microsite univer…6.1
• CVE-2025-54129HAXiam is a packaging wrapper for HAXcms which allows anyone…4.3