Login Request a demo
Medium severity · published Sep 29, 2026
CVE-2026-101858
RaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection
4.7
CVSS
2.5%
EPSS
No
On KEV
Description
A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
raspap-webgui · RaspAP
3.5.0; 3.5.1; 3.5.2; 3.5.3; 3.5.4; 3.5.5 · source: vendor
Affected product
RA
raspap-webgui
RaspAP
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101858
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101858
vdb-entry
https://vuldb.com/vuln/411092
signature
https://vuldb.com/vuln/411092/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-101858
third-party-advisory
https://vuldb.com/submit/930246
exploit
https://gist.github.com/simyat/10422042d6d5225b2beb87754de4b68c
More from raspap-webgui
9.8
CVE-2025-50428
In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script
9.8
CVE-2024-36622
In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script
8.8
CVE-2026-101860
RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management
8.8
CVE-2026-24788
RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability
6.3
CVE-2025-44163
RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php