PT-2025-27229 · Raspap · Raspap

Published 2025-06-27 · Updated 2025-06-27 · CVE-2025-44163

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions: RaspAP raspap-webgui version 3.3.1

Description: The issue allows an authenticated attacker to perform a Directory Traversal attack. This is achieved by sending a crafted POST request to the "ajax/networking/get wgkey.php" endpoint with a path traversal payload in the entity parameter. The vulnerability exploits the tee command used in shell execution, enabling the attacker to overwrite arbitrary files that are writable by the web server.

Recommendations: For RaspAP raspap-webgui version 3.3.1, consider restricting access to the "ajax/networking/get wgkey.php" endpoint until a patch is available. As a temporary workaround, avoid using the entity parameter in the affected endpoint to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Relative Path Traversal

Weakness Enumeration

CWE-22

CWE-23

Related Identifiers

CVE-2025-44163

GHSA-277F-37GW-9GMQ

Affected Products

Raspap

References · 9

• 🔥 https://gist.github.com/YichaoXu/3694f039a3d1b973efd068e4dc662a41 · Exploit
• https://osv.dev/vulnerability/CVE-2025-44163 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-44163 · Security Note
• https://osv.dev/vulnerability/GHSA-277f-37gw-9gmq · Vendor Advisory
• https://github.com/RaspAP/raspap-webgui · Note
• https://github.com/RaspAP/raspap-webgui/blob/125ae7a39ad7c9a71250d3b3e349fd767687ff8d/ajax/networking/get_wgkey.php#L9 · Note
• https://github.com/RaspAP/raspap-webgui/commit/eb53c46c336384d78336b021adea94d9257e1d67 · Note
• https://twitter.com/CVEnew/status/1938671253533139263 · Twitter Post
• https://t.me/cvenotify/126956 · Telegram Post