CraftBeerPi 4 versions from 4.0.0.58 up to but not including 4.4.1.a1 contain a critical vulnerability (CVE-2024-3955) that allows arbitrary code execution. The flaw arises because the "logtime" URL GET parameter is passed without validation to the os.system function, enabling remote attackers to execute arbitrary commands. This vulnerability has a CVSS score of 9.8, indicating a critical severity level. A fix is available in version 4.4.1.a1.