OS Command Injection Vulnerability in RaspAP WebGUI by RaspAP
CVE-2026-101859

5.3MEDIUM

Key Information:

Vendor

Raspap

Status
Raspap-webgui
Vendor
CVE Published:
29 September 2026

Badges

👾 Exploit Exists

What is CVE-2026-101859?

A security flaw in the RaspAP WebGUI, specifically in the OpenVPN Configuration Handler, allows for an OS command injection via a manipulated argument in the function escapeshellcmd. This vulnerability can be exploited remotely, enabling attackers to execute arbitrary commands on the server running the affected version of the RaspAP WebGUI. The issue arises from insufficient validation of user input in the del_ovpncfg.php file, posing significant risks to system integrity and data confidentiality. It is crucial for users to apply the latest updates to mitigate potential threats.

Affected Version(s)

raspap-webgui 3.5.0

raspap-webgui 3.5.1

raspap-webgui 3.5.2

References

https://vuldb.com/vuln/411093
vdb-entrytechnical-description
https://vuldb.com/vuln/411093/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-101859
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

inmoyang (VulDB User)
VulDB CNA Team
.