The vulnerability is an OS command injection found in RaspAP raspap-webgui. Attackers who are authenticated and can log in can supply malicious input that is directly passed to a system shell without proper sanitization. This flaw allows the execution of arbitrary operating‑system commands, compromising confidentiality, integrity, and availability of the affected device. The weakness is classified as CWE‑78.

Vendor RaspAP; product raspap-webgui prior to version 3.3.6 are affected.

The CVSS base score is 8.7, indicating severe risk. EPSS is reported as <1%, implying a very low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user who can log in to the web interface; from that point, the attacker can construct a request that injects arbitrary commands into the underlying shell. The attack path relies on unsanitized user input being executed directly by the OS.