CVE-2025-44163 raspap-webgui has a Directory Traversal vulnerability
An authenticated attacker can exploit a path traversal vulnerability in RaspAP to overwrite arbitrary files, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-44163?
CVE-2025-44163 is a medium-severity path traversal vulnerability in n/a, published on 27 Jun 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php. An authenticated attacker can send a crafted POST request with a path traversal payload in the `entity` parameter to overwrite arbitrary files writable by the web server via abuse of the `tee` command used in shell execution.
Weakness: CWE-23
Which versions are affected by CVE-2025-44163?
2 open source packages ship an affected version, including billz/raspap-webgui. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
billz/raspap-webgui Packagist | All versions | 3.3.6 |
billz/raspap-webgui Packagist | All versions | 3.3.6 |
Products include Raspap Raspap-Webgui.
How do I fix CVE-2025-44163?
Upgrade billz/raspap-webgui to 3.3.6 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-44163 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-44163 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-277f-37gw-9gmq.