/Vulnerability Library

Web-Check < 2.0.1 Screenshot API - OS Command Injection

CVE-2025-32778
Verified

Description

Lissy93/web-check contains a command injection caused by unsanitized user input in the screenshot API, letting attackers execute arbitrary system commands, exploit requires sending crafted url parameters.

Severity

Critical

CVSS Score

9.8

Exploit Probability

20%

Affected Product

web-check

Published Date

May 15, 2026

Template Author

gugacyber, tx1ee

CVE-2025-32778.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2025-32778
CWE ID:
cwe-78

References

https://github.com/Lissy93/web-check/security/advisories/GHSA-jqhf-j4w8-4grrhttps://github.com/Lissy93/web-check/commit/0e4958aa10b2650d32439a799f6fc83a7cd46cefhttps://nvd.nist.gov/vuln/detail/CVE-2025-32778https://osv.dev/vulnerability/CVE-2025-32778

Remediation Steps

Upgrade Web-Check to version 2.0.1 or later. The fix replaces exec() with execFile(), which avoids shell interpretation and properly isolates command arguments.