CVE-2025-63414

An attacker sends a crafted HTTP request to the /html/execute.php endpoint, placing a malicious payload in the id parameter. The application does not properly validate the passed value, resulting in both path traversal capability and direct execution of injected commands at the operating system level. The vulnerability does not require any authentication or user interaction.

An attacker can gain full control over the operating system of the device running Allsky WebUI, including executing arbitrary commands, reading and modifying files, and potentially compromising the entire host.

Apply patches available from the vendor according to the references. Until the fix is deployed, it is recommended to restrict network access to the WebUI interface only to trusted hosts, for example through a firewall or network-level access control mechanisms.

Allsky WebUI version v2024.12.06_06 (Allskyteam Allsky product)