Directory Traversal Vulnerability in RaspAP Web GUI by RaspAP

CVE-2025-44163

What is CVE-2025-44163?

The RaspAP Web GUI version 3.3.1 has a vulnerability that allows an authenticated attacker to exploit the ajax/networking/get_wgkey.php script. By crafting a specific POST request with a malicious path traversal payload in the entity parameter, the attacker can manipulate the tee command executed on the server, potentially overwriting arbitrary files that are writable by the web server. This could lead to unauthorized access or modification of critical files, compromising the integrity of the web application and the underlying system.

References