CVE-2025-63414
CriticalSummary
A Path Traversal vulnerability in Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary command execution. By sending a crafted HTTP request to the /html/execute.php endpoint with a malicious payload in the id parameter, an attacker can execute arbitrary commands on the underlying OS, leading to full RCE.
Risk Assessment
An unauthenticated attacker can gain full control of the system, potentially compromising data confidentiality, integrity, and availability.
Recommendation
Immediately update Allsky WebUI to a patched version and restrict access to the web interface to trusted networks only.
Original NVD description (English source)
A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary command execution. By sending a crafted HTTP request to the /html/execute.php endpoint with a malicious payload in the id parameter, an attacker can execute arbitrary commands on the underlying operating system, leading to full remote code execution (RCE).