RaspAP raspap-webgui contains an OS Command Injection vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2026-24788 · ADVISORY
• RaspAP/raspap-webgui commit f514f5a · WEB
• RaspAP/raspap-webgui · PACKAGE
• RaspAP/raspap-webgui release 3.3.6 · WEB
• jvn.jp/en/jp/JVN27202136 · WEB
• RaspAP/raspap-webgui release
• jvn.jp/en/jp/JVN27202136

Weitere Schwachstellen in billz/raspap-webgui

• CVE-2025-44163MITTEL 6.3RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php. An authenticated attacker can send a craft…
• CVE-2024-41637HOCH 8.3RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also posse…
• CVE-2024-2497HOCH 7.2A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical. This issue affects some unknown processing of the file i…
• CVE-2024-28754HOCH 7.5RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent denial of service (bricking) via a crafted request.
• CVE-2022-39987HOCH 8.8A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via t…