billz/raspap-webgui

Clear licensing, release notes, and a substantial README make the package easier to evaluate and maintain. The organization-backed project is active, but concentrated recent development and workflow pinning gaps leave some maintenance and build-integrity risk.

Latest 3.5.6

Packagist

71%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Are you affected? Scan for Free

Health Score Breakdown

Repo bus factor

One contributor made 100% of the 26 commits in the last three months. Organization ownership provides some handoff capacity, but no second recent contributor is shown.

Repo commit activity

The repository had 26 commits in the last three months, showing current activity, although all recent commits came from one active maintainer.

Workflow audit

All five workflows were analyzed, but all 12 action references are unpinned and one workflow has top-level write permissions. The high-confidence template-injection finding is in the release workflow; the pull_request_target trigger is in a different workflow, so it is a hygiene concern rather than a severe combined exploit signal.

Vulnerabilities

Title	Versions	Severity
CVE-2026-24788 billz/raspap-webgui is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 0.0.0 - 3.3.6.	0.0.0 - 3.3.6	High
CVE-2025-44163 billz/raspap-webgui is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 3.3.6.	0.0.0 - 3.3.6	High
CVE-2024-41637 billz/raspap-webgui is vulnerable to Improper Neutralization of Special Elements used in a Command ('Command Injection') in versions 0.0.0 - 3.1.4.	0.0.0 - 3.1.4	Critical
CVE-2024-2497 billz/raspap-webgui is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 0.0.0 - 3.0.9.	0.0.0 - 3.0.9	Medium
CVE-2024-28754 billz/raspap-webgui is vulnerable to Security Vulnerability in versions 0.0.0 - 3.1.0.	0.0.0 - 3.1.0	High