[HIGH] RaspAP raspap-webgui contains an OS Command Injection vulnerability

PKSA-vf1y-yyyt-3znd CVE-2026-24788 GHSA-4wwf-f7w3-94f5

Affected version: <3.3.6

Reported by:
GitHub

[HIGH] raspap-webgui has a Directory Traversal vulnerability

PKSA-39wq-fxs7-zymy CVE-2025-44163 GHSA-277f-37gw-9gmq

Affected version: <3.3.6

Reported by:
GitHub

[CRITICAL] RaspAP allows an attacker to escalate privileges

PKSA-fnmc-s4nq-ydpw CVE-2024-41637 GHSA-q623-2j2j-23jj

Affected version: <=3.1.4

Reported by:
GitHub

[MEDIUM] RaspAP Vulnerable to Code Injection via an Unknown Process in File `includes/provider.php`

PKSA-cfpm-fx6k-5ggt CVE-2024-2497 GHSA-99wg-vmvq-2cp5

Affected version: <=3.0.9

Reported by:
GitHub

[HIGH] raspap-webgui vulnerable to denial of service

PKSA-4gh1-k8dy-rw9d CVE-2024-28754 GHSA-vc9f-mgxr-h32r

Affected version: <3.1.0

Reported by:
GitHub