{"id":"GHSA-hhqm-f4m4-pq39","aliases":["CVE-2023-30260"],"title":"RaspAP raspap-webgui Command Injection vulnerability","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.","severity":"high","score":8.8,"published":"2023-06-23T12:30:18.000Z","modified":"2024-02-16T08:20:34.740Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"billz/raspap-webgui","sources":[{"name":"OSV · GHSA-hhqm-f4m4-pq39","url":"https://osv.dev/vulnerability/GHSA-hhqm-f4m4-pq39"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.8.9"}],"type":"ECOSYSTEM"}],"versions":["1.0","2.4.1","2.5","2.5.1","2.5.2","2.6","2.6-beta","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.7.0","2.7.1","2.8.0","2.8.1","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8"],"fixed":["2.8.9"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2023-30260","https://github.com/RaspAP/raspap-webgui/pull/1322","https://github.com/RaspAP/raspap-webgui/commit/238e1670fcef8b18ec4628ee74fc345607536a16","https://eldstal.se/advisories/230328-raspap.html","https://github.com/RaspAP/raspap-webgui"],"sources":[{"name":"OSV","id":"GHSA-hhqm-f4m4-pq39","modified":"2024-02-16T08:20:34.740160Z","url":"https://osv.dev/vulnerability/GHSA-hhqm-f4m4-pq39"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T19:30:46.166Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}