GitHub Advisoryadvisory · Packagist

GHSA-4wwf-f7w3-94f5 RaspAP raspap-webgui contains an OS Command Injection vulnerability

HIGH Published 2026-02-02 Modified 2026-02-02 Official page ↗
Aliases
CVE-2026-24788
Ecosystem
Packagist
Packages
billz/raspap-webgui
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2026-02-02

Affected packages

• Packagist billz/raspap-webgui: < 3.3.6 → fixed in 3.3.6

Description

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS Command Injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product.

Related

Alias · CVE (1)

  • CVE-2026-24788 RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References