{"id":"CVE-2024-3955","aliases":["GHSA-4f92-w438-f484","PYSEC-2026-308"],"title":"CraftBeerPi 4 allows arbitrary code execution","summary":"CraftBeerPi 4 allows arbitrary code execution","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"cbpi4","product":"cbpi4","ecosystem":"pip","affected":["cbpi4 >= 4.0.0.58, < 4.4.1.a1"],"patched":["cbpi4 4.4.1.a1"],"published":"2024-05-02","updated":"2026-10-27","sourceUpdated":"2026-10-27T16:30:06.791472908Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-4f92-w438-f484","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3955"},{"url":"https://github.com/PiBrewing/craftbeerpi4/issues/132"},{"url":"https://cert.pl/en/posts/2024/05/CVE-2024-3955"},{"url":"https://cert.pl/posts/2024/05/CVE-2024-3955"},{"url":"https://github.com/PiBrewing/craftbeerpi4"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/cbpi4/PYSEC-2026-308.yaml"},{"url":"https://pypi.org/project/cbpi4"},{"url":"https://github.com/advisories/GHSA-4f92-w438-f484"}],"tags":["osv","pip","ghsa"],"epss":0.01149,"epssPercentile":0.66681,"cwe":["CWE-94"],"ingestedAt":"2026-10-27T16:32:34.361Z","slug":"CVE-2024-3955","body":"## Overview\n\nURL GET parameter \"logtime\" utilized within the \"downloadlog\" function from \"cbpi/http_endpoints/http_system.py\" is subsequently passed to the \"os.system\" function in \"cbpi/controller/system_controller.py\" without prior validation allowing arbitrary code execution. This issue affects CraftBeerPi 4: from 4.0.0.58 (commit 563fae9) before 4.4.1.a1 (commit 57572c7).\n\n## Affected packages\n\n- `cbpi4 >= 4.0.0.58, < 4.4.1.a1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `cbpi4 4.4.1.a1`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}