CVE-2025-32778 Web-Check allows command Injection via Unvalidated URL in Screenshot API
Attackers can execute arbitrary system commands via unsanitized URL input in the screenshot API, potentially extracting files or gaining remote access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-32778?
CVE-2025-32778 is a critical command injection vulnerability in Lissy93 web-check, published on 15 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screenshot API of the Web Check project (Lissy93/web-check). The issue stems from user-controlled input (url) being passed unsanitized into a shell command using exec(), allowing attackers to execute arbitrary system commands on the underlying host. This could be exploited by sending crafted url parameters to extract files or even establish remote access. The vulnerability has been patched by replacing exec() with execFile(), which avoids using a shell and properly isolates arguments.
Weakness: CWE-78
Which versions are affected by CVE-2025-32778?
How do I fix CVE-2025-32778?
No fix has been published for CVE-2025-32778 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-32778 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-32778 exists.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 1 proofs of concept on GitHub.
Sources
Also known as GHSA-5qg5-g7c2-pfx8.