CVE-2026-101859 in raspap-webgui
Summary
by MITRE • 09/29/2026
A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/del_ovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfg_id leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in RaspAP raspap-webgui versions up to 3.5.5 represents a critical security flaw within the OpenVPN Configuration Handler component, specifically located in the ajax/openvpn/del_ovpncfg.php file. This issue stems from an improper neutralization of special elements used in an operating system command, commonly referred to as OS Command Injection. The root cause lies in the misuse or insufficient sanitization of the escapeshellcmd function when processing the cfg_id argument. While escapeshellcmd is designed to escape characters that have a special meaning in the shell, it does not protect against all forms of injection attacks, particularly those involving arguments passed directly to system functions without proper validation or use of safer alternatives like exec with array parameters. The failure to adequately sanitize this input allows an attacker to inject arbitrary operating system commands into the execution context of the application.
This vulnerability is classified under CWE-78, which covers Improper Neutralization of Special Elements used in an OS Command. From a tactical perspective, it aligns with MITRE ATT&CK technique T1059, specifically sub-technique 004 for Command and Scripting Interpreter abuse. The presence of this flaw significantly expands the attack surface of any device running RaspAP, as it enables remote code execution without requiring authentication in many configurations or allows privilege escalation if authenticated access is required but poorly controlled. Since the exploit has been publicly disclosed, automated scanning tools and malicious actors can readily leverage this vulnerability to compromise target systems. The lack of response from the vendor further exacerbates the risk, leaving users with no official patch or guidance for remediation through standard update channels.
The operational impact of this command injection is severe. An attacker who exploits this flaw can execute arbitrary commands on the underlying operating system with the privileges of the web server process. This typically results in full compromise of the Raspberry Pi device hosting RaspAP, including access to sensitive network configurations, credentials stored within OpenVPN profiles, and potentially lateral movement into other parts of the local network if the compromised host serves as a gateway or router. The ability to run commands remotely means that physical access is not required, making this a high-severity remote vulnerability. Given that RaspAP is often used in home networks and small business environments where security hygiene may be less rigorous than in enterprise settings, the potential for widespread exploitation is significant.
Mitigation strategies must focus on immediate isolation and manual remediation since vendor support is unavailable. Administrators should immediately restrict access to the RaspAP web interface by placing it behind a firewall or VPN that requires strong authentication before reaching the application layer. If possible, disabling the OpenVPN configuration management features entirely until a secure alternative is implemented can reduce exposure. For those who must continue using this version, implementing strict input validation at the application level is necessary, though this may require modifying source code directly. Replacing escapeshellcmd with more robust parameterization methods or avoiding shell execution altogether by using native libraries for OpenVPN management would resolve the technical flaw. Additionally, monitoring network traffic for unusual outbound connections from affected devices can help detect active exploitation attempts while longer-term architectural changes are planned to replace vulnerable components with secure alternatives.