HIGH8.8

GHSA-4wwf-f7w3-94f5

RaspAP raspap-webgui contains an OS Command Injection vulnerability

Quick fix

GHSA-4wwf-f7w3-94f5 — billz/raspap-webgui: upgrade to the fixed version with the command below.

composer require billz/raspap-webgui:^3.3.6

Details

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS Command Injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/billz/raspap-webgui

Introduced in: 0Fixed in: 3.3.6

Fixcomposer require billz/raspap-webgui:^3.3.6

References

https://nvd.nist.gov/vuln/detail/CVE-2026-24788[ADVISORY]
https://github.com/RaspAP/raspap-webgui/commit/f514f5a12ef0c34853b5370ef55d630b499f977d[WEB]
https://github.com/RaspAP/raspap-webgui[PACKAGE]
https://github.com/RaspAP/raspap-webgui/releases/tag/3.3.6[WEB]
https://jvn.jp/en/jp/JVN27202136[WEB]