CVE-2024-36622 — In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script

Back Back to CVE browser

CRITICAL

In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script

Published Nov 29, 2024

9.8

CRITICAL

CVSS 3.1

EPSS 2.84%

Description

In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper sanitization of user input passed via the logfile parameter.

Affected products

Remediation

No remediation recorded yet.

Metrics

2.84% 0.02838

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.02838

Score over time

2024–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	2.84% (0.02838)	86.18th	v5 (v2026.06.15)
Jun 15, 2026	2.71% (0.02705)	83.96th	v5 (v2026.06.15)
Nov 21, 2025	1.42% (0.01418)	79.99th	v4 (v2025.03.14)
Nov 18, 2025	6.56% (0.06560)	90.21th	v4 (v2025.03.14)
Mar 30, 2025	0.88% (0.00880)	73.25th	v4 (v2025.03.14)
Mar 29, 2025	7.42% (0.07423)	85.94th	v4 (v2025.03.14)
Mar 17, 2025	0.88% (0.00880)	73.74th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00045)	17.70th	v3 (v2023.03.01)
Nov 30, 2024	0.04% (0.00045)	17.27th	v3 (v2023.03.01)

Weaknesses (1)

CWE-94

Code Injection

References (3)

Link	Providers	Tags
https://gist.github.com/1047524396/ab997b902ec892e592a0df93f38e6941		Third Party Advisory
https://github.com/RaspAP/raspap-webgui/blob/3.0.9/ajax/logging/clearlog.php		Product
https://github.com/raspap/raspap-webgui/commit/c98d2b0c15942b4829d31dec615b9b40cc6faa14#diff-939ee414d82245c3b3dd7d36b57f10706e06e8f0871b24bdcf9de6e0d181c4c9		Patch