CVE-2026-101860 in raspap-webgui
Summary
by MITRE • 09/29/2026
A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified within RaspAP raspap-webgui versions up to 3.5.5 represents a critical failure in access control mechanisms, specifically located in the PluginInstaller::addSudoers function found in the src/RaspAP/Plugins/PluginInstaller.php file. This component is responsible for managing sudo configuration settings when installing or updating plugins within the RaspAP environment. The core technical flaw lies in improper privilege management, where the application fails to adequately validate inputs before executing commands that require elevated system privileges. By manipulating specific parameters passed to this function, an attacker can inject malicious content into the sudoers file or alter existing configurations to grant unauthorized users root-level access. This type of vulnerability is classically categorized under CWE-269 Improper Privilege Management and often intersects with CWE-78 OS Command Injection if the manipulation allows for arbitrary command execution through the compromised configuration files.
The operational impact of this flaw is severe, as it effectively bypasses the security boundaries intended to protect the underlying operating system. Since RaspAP is frequently deployed on Raspberry Pi devices which are commonly used in IoT and edge computing scenarios, gaining root access via this vulnerability can lead to complete compromise of the device. An attacker could install persistent backdoors, exfiltrate sensitive data stored on the device, or use the compromised node as a pivot point for further attacks within the local network. The severity is exacerbated by the fact that the exploit has been made public and is actively available in the wild. This means that automated scanning tools and malicious actors can readily identify vulnerable instances without needing to develop custom exploitation code, significantly increasing the risk of widespread compromise across unprotected deployments.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Privilege Escalation on Linux systems, specifically T1548 Abuse Elevation Control Mechanism and potentially T1098 Account Manipulation if new accounts are created via the sudoers file. The ability to manipulate configuration files remotely indicates that an attacker does not need physical access or prior authentication to a high-privilege account, assuming they can interact with the web interface which may have its own authentication weaknesses or be exposed directly to untrusted networks in some configurations. This remote exploitability transforms what might otherwise be a local privilege escalation issue into a significant remote code execution vector depending on how the sudoers changes are interpreted by the system during subsequent operations.
Mitigation strategies must prioritize immediate remediation given the public availability of exploits and the lack of response from the vendor. The most effective solution is to upgrade RaspAP raspap-webgui to version 3.5.6 or later, where this input validation issue has been addressed. For environments where upgrading is not immediately feasible, administrators should implement strict network segmentation to ensure that the web interface is only accessible via trusted internal networks and protected by strong authentication mechanisms such as multi-factor authentication. Additionally, deploying a Web Application Firewall with rules specifically targeting sudoers manipulation patterns can provide an additional layer of defense. Regular auditing of system logs for unusual changes to /etc/sudoers or related configuration files is also recommended to detect potential exploitation attempts early. Given the vendor's non-response, users should consider alternative management interfaces if long-term support and security updates are critical to their operational requirements.