Raspap-webgui vulnerabilities

5 known vulnerabilities in Raspap-webgui from RaspAP. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  raspap-webgui: Incorrect Privilege Assignment

  CVE-2026-101860Sep 29, 2026RaspAP

  A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in impro

• 8.7 High severity

  raspap-webgui: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-24788Feb 2, 2026RaspAPEPSS 1.35%

  RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product.

• 9.8 Critical severity

  Raspap-webgui: Improper Neutralization of Special Elements used in a Command

  CVE-2025-50428Aug 27, 2025RaspAPEPSS 1.63%

  In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script. The vulnerability is due to improper sanitizing of user input passed via the interface parameter.

• 9.8 Critical severity

  Raspap-webgui: Improper Control of Generation of Code

  CVE-2024-36622Nov 29, 2024RaspAPEPSS 2.84%

  In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper sanitization of user input passed via the logfile parameter.

• 7.2 High severity

  raspap-webgui: Improper Control of Generation of Code

  CVE-2024-2497Mar 15, 2024RaspAP

  A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical. This issue affects some unknown processing of the file includes/provider.php of the component HTTP POST Request Handler. The manipulation of the argument country leads to code