PatchTheCVEraspap-webgui vulnerabilities and fixes
Recent CVEs affecting raspap-webgui, with upgrade or downgrade steps. 3 tracked.
Also searched as: raspap webgui.
raspap-webgui has 3 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 2. Most recent: 2025-08-27. Highest priority: CVE-2025-50428 (score 66/100).
- CVE-2025-50428 CRITICAL 9.8 UPGRADE In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.ph
- CVE-2025-44163 MEDIUM 6.3 DOWNGRADE RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php
- CVE-2024-36622 CRITICAL 9.8 UPGRADE In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script
FAQ
How do I fix raspap-webgui vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is raspap-webgui being exploited right now?
None of the tracked raspap-webgui CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which raspap-webgui CVE should I patch first?
CVE-2025-50428 currently ranks highest (66/100): In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.ph.