# billz/raspap-webgui (Packagist) vulnerabilities

10 known vulnerabilities (3 high, 2 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/billz/raspap-webgui

## Advisories (10)

### [CVE-2026-24788](https://cve.now/CVE-2026-24788): RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability.

- Severity: High 8.8
- Published: Feb 2, 2026
- Affected: fixed in 3.3.6.

### [CVE-2025-44163](https://cve.now/CVE-2025-44163): RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get\_wgkey.php.

- Severity: Medium 6.3
- Published: Jun 27, 2025
- Affected: fixed in 3.3.6.

### [CVE-2024-41637](https://cve.now/CVE-2024-41637): RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also…

- Severity: High 8.3
- Published: Jul 29, 2024
- Affected: through 3.1.4.

### [CVE-2024-2497](https://cve.now/CVE-2024-2497): RaspAP raspap-webgui HTTP POST Request provider.php code injection

- Severity: Medium 4.7
- Published: Mar 15, 2024
- Affected: through 3.0.9.

### [CVE-2024-28754](https://cve.now/CVE-2024-28754): RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent denial of service (bricking) via a crafted request.

- Severity: High 7.5
- Published: Mar 8, 2024
- Affected: fixed in 3.1.0.

### [CVE-2022-39987](https://cve.now/CVE-2022-39987): A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via…

- Severity: Unrated
- Published: Aug 1, 2023
- Affected: from 2.8.0, fixed in 2.9.5.

### [CVE-2022-39986](https://cve.now/CVE-2022-39986): A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg\_id…

- Severity: Unrated
- Published: Aug 1, 2023
- Affected: from 2.8.0, fixed in 2.8.8.

### [CVE-2023-30260](https://cve.now/CVE-2023-30260): Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted…

- Severity: Unrated
- Published: Jun 23, 2023
- Affected: fixed in 2.8.9.

### [CVE-2021-38556](https://cve.now/CVE-2021-38556): includes/configure\_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.

- Severity: Unrated
- Published: Aug 24, 2021
- Affected: through 2.6.6.

### [CVE-2021-38557](https://cve.now/CVE-2021-38557): raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.

- Severity: Unrated
- Published: Aug 24, 2021
- Affected: through 2.6.6.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/billz/raspap-webgui
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.