CVE-2026-101859: RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection
A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker needs privileges, as reflected by the PR:L vector. The affected functionality is the OpenVPN Configuration Handler's deletion endpoint, ajax/openvpn/del_ovpncfg.php.
What attacker-controlled input is involved?
The cfg_id argument can be manipulated to trigger operating-system command injection through the endpoint's use of escapeshellcmd.
Are publicly available exploits a concern?
Yes. The exploit has been publicly disclosed and may be used, so exposed instances should be treated as having elevated exploitation risk.
Which versions are known to be affected?
RaspAP raspap-webgui versions up to and including 3.5.5 are identified as affected. No fixed version is provided in the available data.