Medium severity · published Sep 29, 2026
CVE-2026-101859
RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection
5.4
CVSS
1.6%
EPSS
No
On KEV
Description
A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/del_ovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfg_id leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
raspap-webgui · RaspAP
3.5.0; 3.5.1; 3.5.2; 3.5.3; 3.5.4; 3.5.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101859
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101859
vdb-entry
https://vuldb.com/vuln/411093
signature
https://vuldb.com/vuln/411093/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-101859
third-party-advisory
https://vuldb.com/submit/930258
exploit
https://gist.github.com/simyat/10422042d6d5225b2beb87754de4b68c
More from raspap-webgui
9.8
CVE-2025-50428
In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script
9.8
CVE-2024-36622
In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script
8.8
CVE-2026-101860
RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management
8.8
CVE-2026-24788
RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability
6.3
CVE-2025-44163
RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php