high8.8
CVE-2026-24788
RaspAP raspap-webgui contains an OS Command Injection vulnerability
Impact
RaspAP raspap-webgui versions prior to 3.3.6 contain an OS Command Injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | billz/raspap-webgui | < 3.3.6 | 3.3.6 |
Affected products
| Product | Affected versions |
|---|---|
| RaspAP Raspap-Webgui | before 3.3.6 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/RaspAP/raspap-webgui/releases
- https://jvn.jp/en/jp/JVN27202136/
- https://github.com/advisories/GHSA-4wwf-f7w3-94f5
- https://nvd.nist.gov/vuln/detail/CVE-2026-24788
- https://jvn.jp/en/jp/JVN27202136
- https://github.com/RaspAP/raspap-webgui/commit/f514f5a12ef0c34853b5370ef55d630b499f977d
- https://github.com/RaspAP/raspap-webgui/releases/tag/3.3.6