PT-2025-16396 · Webcheck · Webcheck

Git-Msk · Published 2025-04-15 · Updated 2025-04-17 · CVE-2025-32778

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Web-Check versions (affected versions not specified)

Description A command injection issue exists in the screenshot API of the Web Check project, stemming from user-controlled input (url) being passed unsanitized into a shell command using exec(), allowing attackers to execute arbitrary system commands on the underlying host. This could be exploited by sending crafted url parameters to extract files or even establish remote access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-32778

GHSA-5QG5-G7C2-PFX8

Affected Products

Webcheck

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32778.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-32778 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32778 · Security Note
• https://github.com/Lissy93/web-check/commit/0e4958aa10b2650d32439a799f6fc83a7cd46cef · Note
• https://github.com/Lissy93/web-check/security/advisories/GHSA-5qg5-g7c2-pfx8 · Note
• https://github.com/Lissy93/web-check/pull/243 · Note
• https://twitter.com/cybercronai/status/1912657871600222628 · Twitter Post
• https://twitter.com/CveFindCom/status/1912242550770987356 · Twitter Post
• https://twitter.com/CVEnew/status/1912253262943715607 · Twitter Post
• https://t.me/cvetracker/21681 · Telegram Post