All vulnerabilities
CVE-2024-3955GHSA-4f92-w438-f484PYSEC-2026-308

cbpi4: CraftBeerPi 4 allows arbitrary code execution

PiBrewing cbpi4pipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)1.15%Chance of exploitation activity in the next 30 days, higher than 66% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed in4.4.1.a1Also 4.4.1.a1 (commit 57572c7)GitHub
Published2 May 2024Updated 27 Oct 2026CVE List

What fixes it

  • 4.4.1.a1cbpi4, pipGitHub
  • 4.4.1.a1 (commit 57572c7)CraftBeerPi 4CVE List
  • 4.4.1.a1cbpi4, PyPIOSVpip install "cbpi4>=4.4.1.a1"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

URL GET parameter "logtime" utilized within the "downloadlog" function from "cbpi/http_endpoints/http_system.py" is subsequently passed to the "os.system" function in "cbpi/controller/system_controller.py" without prior validation allowing arbitrary code execution. This issue affects CraftBeerPi 4: from 4.0.0.58 (commit 563fae9) before 4.4.1.a1 (commit 57572c7).

Text from CVE List

Affected versions 34

  • cbpi4, pip>= 4.0.0.58, < 4.4.1.a1GitHub
  • CraftBeerPi 4affected: 4.0.0.58 (commit 563fae9) before 4.4.1.a1 (commit 57572c7)CVE List
  • CraftBeerPi 4affected: 4.0.0.58 (commit 563fae9)CVE List
  • cbpi4, PyPIfrom 4.0.0.58, fixed in 4.4.1.a1OSV
  • cbpi4, PyPI4.0.5OSV
  • cbpi4, PyPI4.0.5a13OSV
  • cbpi4, PyPI4.0.5a14OSV
  • cbpi4, PyPI4.0.5a15OSV
  • cbpi4, PyPI4.0.5a16OSV
  • cbpi4, PyPI4.0.6OSV
  • cbpi4, PyPI4.0.7OSV
  • cbpi4, PyPI4.0.7rc1OSV
  • cbpi4, PyPI4.0.7rc3OSV
  • cbpi4, PyPI4.1.0OSV
  • cbpi4, PyPI4.1.0a2OSV
  • cbpi4, PyPI4.1.0a3OSV
  • cbpi4, PyPI4.1.0rc1OSV
  • cbpi4, PyPI4.1.0rc2OSV
  • cbpi4, PyPI4.1.0rc5OSV
  • cbpi4, PyPI4.1.0rc8OSV
  • cbpi4, PyPI4.1.10OSV
  • cbpi4, PyPI4.1.10rc2OSV
  • cbpi4, PyPI4.1.11OSV
  • cbpi4, PyPI4.1.2OSV
  • cbpi4, PyPI4.1.6OSV
  • cbpi4, PyPI4.1.7OSV
  • cbpi4, PyPI4.1.7rc1OSV
  • cbpi4, PyPI4.2.0OSV
  • cbpi4, PyPI4.2.0a6OSV
  • cbpi4, PyPI4.2.0rc1OSV
  • cbpi4, PyPI4.3.0OSV
  • cbpi4, PyPI4.3.1OSV
  • cbpi4, PyPI4.3.2OSV
  • cbpi4, PyPI4.4.0OSV

References 9