8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24788

CVE-2026-24788: RaspAP raspap-webgui contains an OS Command Injection vulnerability

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24788

CVE-2026-24788:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
billz/raspap-webgui	composer	< 3.3.6	3.3.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an OS command injection in the raspap-webgui software. The analysis of the patch commit f514f5a12ef0c34853b5370ef55d630b499f977d reveals that the vulnerability lies in the includes/locale.php file. The script was using a user-controllable session variable, $_SESSION['locale'], directly in a call to putenv(). An authenticated user could manipulate this session variable by sending a POST request with a crafted locale parameter. The lack of sanitization allowed for the injection of arbitrary OS commands. The patch addresses this by adding two main fixes: first, it validates the user-provided locale from the POST request against a strict allowlist; second, it uses the escapeshellarg() function to properly sanitize the value before it is passed to putenv(). The vulnerability does not reside within a specific function but in the global scope of the includes/locale.php script, which is executed when included by other pages in the application.

Vulnerable functions

(global scope)

includes/locale.php

The script `includes/locale.php` is vulnerable to OS command injection. An authenticated user could send a POST request with a crafted `locale` parameter. This input was used to set the `$_SESSION['locale']` variable, which was then used, unsanitized, in a call to the `putenv` function. This allows an attacker to execute arbitrary commands on the operating system. The patch mitigates this by validating the `locale` input against a list of allowed values and by using `escapeshellarg` to sanitize the value before passing it to `putenv`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.