Description
A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via the "entity" POST parameters in /ajax/networking/get_wgkey.php.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | billz/raspap-webgui | >= 2.8.0, < 2.9.5 | 2.9.5 | GHSA-7r88-wjhj-jr8m |