CVE-2022-36749: Sourcefabric Rpi-Jukebox-Rfid

Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days.

RPi-Jukebox-RFID v2.3.0 was discovered to contain a command injection vulnerability via the component /htdocs/utils/Files.php. This vulnerability is exploited via a crafted payload injected into the file name of an uploaded file.

Affected products

• Sourcefabric Rpi-Jukebox-Rfid: version 2.3.0 only

Published 2022-08-30. Last modified 2026-06-17.