RaspAP vulnerabilities
We track 9 vulnerabilities in RaspAP products across 2 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on September 29, 2026.
Latest RaspAP vulnerabilities
- 8.8 High severity
raspap-webgui: Incorrect Privilege Assignment
A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in impro
- 8.7 High severity
raspap-webgui: Improper Neutralization of Special Elements used in an OS Command
RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product.
- 9.8 Critical severity
Raspap-webgui: Improper Neutralization of Special Elements used in a Command
In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script. The vulnerability is due to improper sanitizing of user input passed via the interface parameter.
- 9.8 Critical severity
Raspap-webgui: Improper Control of Generation of Code
In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper sanitization of user input passed via the logfile parameter.
- 8.3 High severity
raspap: Improper Neutralization of Special Elements used in a Command
RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also possesses Sudo privileges to execute several critical commands without a password.
- 7.2 High severity
raspap-webgui: Improper Control of Generation of Code
A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical. This issue affects some unknown processing of the file includes/provider.php of the component HTTP POST Request Handler. The manipulation of the argument country leads to code
- 8.8 High severity
Raspap: Improper Neutralization of Special Elements used in a Command
A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via the "entity" POST parameters in /ajax/networking/get_wgkey.php.
- 9.8 Critical severity
Raspap: Improper Neutralization of Special Elements used in a Command
A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php.
- 8.8 High severity
Raspap: Improper Neutralization of Special Elements used in a Command
Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.