CVE-2022-36749

Deeper analysis

RPi-Jukebox-RFID version 2.3.0 contains a command injection vulnerability in the component /htdocs/utils/Files.php. The flaw, tracked as CVE-2022-36749 and assigned CWE-78, permits an attacker to supply a crafted filename during file upload that results in arbitrary command execution on the underlying system. The issue received a CVSS 3.1 base score of 9.8, reflecting network attack vector, low complexity, and no required authentication or user interaction.

An unauthenticated remote attacker can exploit the vulnerability by uploading a file whose name contains shell metacharacters or command sequences. Successful exploitation grants the ability to execute arbitrary operating-system commands, leading to full confidentiality, integrity, and availability impact on the affected device.

The EPSS score for this CVE rose from a low baseline after disclosure to a peak of 0.1279 on 2025-12-11 before receding to its current value of 0.0269, indicating a period of increased exploitation interest that later subsided. The two referenced GitHub issues provide the primary public discussion of the flaw but contain no additional mitigation details beyond the original report.