CVE-2025-44163

Vulnerability

Overview

CVE-2025-44163 is a directory traversal vulnerability in the RaspAP raspap-webgui version 3.3.1, specifically in the ajax/networking/get_wgkey.php endpoint [1][3]. The root cause is insufficient sanitization of the entity parameter in a POST request. When the parameter value is passed to a shell command that uses tee, an authenticated attacker can inject path traversal sequences (e.g., ../) to redirect output to arbitrary files outside the intended directory [2][4].

Exploitation

Conditions

Exploitation requires prior authentication to the RaspAP web interface [3]. An attacker can send a crafted POST request to the vulnerable endpoint, embedding a path traversal payload in the entity parameter. The lack of input escaping allows the attacker to control the file path written by the tee command [2]. The commit fix (eb53c46) introduced escapeshellarg() on the entity value, confirming that the parameter was previously passed unsanitized into shell execution [2].

Impact

An authenticated attacker can overwrite any file on the system that is writable by the web server process [3]. This could lead to privilege escalation, persistent backdoor installation, or disruption of the RaspAP service. Since RaspAP often runs with elevated privileges on network devices (e.g., Raspberry Pi) [1], overwriting configuration files or system binaries could have severe consequences.

Mitigation

Status

As of the publication date, a fix has been committed to the RaspAP repository, which uses escapeshellarg() to properly escape the entity parameter before shell execution [2]. Users should update to the latest version of raspap-webgui that includes this commit. No CVE mentions inclusion in CISA Known Exploited Vulnerabilities (KEV) catalog.