CVE-2025-32778 Details
Description
Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screenshot API of the Web Check project (Lissy93/web-check). The issue stems from user-controlled input (url) being passed unsanitized into a shell command using exec(), allowing attackers to execute arbitrary system commands on the underlying host. This could be exploited by sending crafted url parameters to extract files or even establish remote access. The vulnerability has been patched by replacing exec() with execFile(), which avoids using a shell and properly isolates arguments.
A command injection vulnerability has been identified in the screenshot API of the Web Check project (Lissy93/web-check) in versions prior to 2.0.0. The vulnerability arises from user-controlled input being passed unsanitized into a shell command via exec(), which allows attackers to execute arbitrary system commands on the host. Exploitation could involve sending crafted URL parameters to extract files or establish remote access.
Users can update to version 2.0.1 or apply the specific commit that addresses this vulnerability by replacing exec() with execFile(), which prevents shell interpolation and execution.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 15, 2025CISA-ADP
Assessed Apr 15, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Lissy93/web-check/commit/0e4958aa10b2650d32439a799f6fc83a7cd46cef | [email protected] | Source CodeVendor |
| https://github.com/Lissy93/web-check/pull/243 | [email protected] | Issue TrackingVendor |
| https://github.com/Lissy93/web-check/security/advisories/GHSA-5qg5-g7c2-pfx8 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Lissy93 web-check | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 15, 2025 | New CVE Received | [email protected] |