| Package | Affected versions | Patched versions |
|---|---|---|
| billz/raspap-webgui | < 3.3.6 | 3.3.6 |
| raspap-webgui | = 3.3.1 |
RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php. An authenticated attacker can send a crafted POST request with a path traversal payload in the entity parameter to overwrite arbitrary files writable by the web server via abuse of the tee command used in shell execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free