Threat database

CVE-2026-101859 is an OS command injection vulnerability in the RaspAP raspap-webgui up to version 3.5.5. It affects the escapeshellcmd function in the ajax/openvpn/del_ovpncfg.php file within the OpenVPN Configuration Handler component. The vulnerability allows remote attackers to manipulate the cfg_id argument to execute arbitrary OS commands. The vulnerability has been publicly disclosed, but the vendor has not responded or issued a fix. The CVSS score is 5.3, indicating a medium severity level.

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-24788 is a high-severity OS command injection vulnerability in raspap-webgui versions prior to 3.3.6. It allows an authenticated user with login access to execute arbitrary OS commands due to improper neutralization of special elements. The vulnerability has a CVSS score of 8.8, indicating critical impacts on confidentiality, integrity, and availability without requiring user interaction. Exploitation could lead to full system compromise of devices running the vulnerable RaspAP web interface. Although no known exploits are currently reported in the wild, the ease of exploitation and potential damage make timely patching essential. European organizations using RaspAP for wireless access point management, especially in sectors relying on Raspberry Pi devices, are at risk. Countries with higher adoption of Raspberry Pi-based network solutions and critical infrastructure deployments are more likely to be affected.

RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php. An authenticated attacker can send a crafted POST request with a path traversal payload in the `entity` parameter to overwrite arbitrary files writable by the web server via abuse of the `tee` command used in shell execution.

In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper sanitization of user input passed via the logfile parameter.

RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also possesses Sudo privileges to execute several critical commands without a password.