RaspAP WebGUI CVE-2026-101859

Requires an authenticated low-privilege session (PR:L) on the RaspAP web GUI and that the OpenVPN configuration feature exposing ajax/openvpn/del_ovpncfg.php is reachable. The attacker manipulates the cfg_id parameter, whose value is passed through escapeshellcmd() - an incomplete filter that still permits argument/command injection. Limiting factors: authentication is mandatory (no unauthenticated path), exploitation is constrained by escapeshellcmd so it is argument injection rather than unrestricted RCE, and it affects RaspAP raspap-webgui versions up to and including 3.5.5. No user interaction is required.

This is a genuine but moderate-priority command-injection flaw, not a high-CVSS-but-low-real-risk artifact. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) confirms remote, low-complexity, no-interaction reach, but PR:L means an attacker must already hold an authenticated low-privilege session on the RaspAP web UI - a meaningful barrier that keeps the vendor score at 5.3 despite the CWE-78 classification. Impact is capped at VI:L/VA:L with VC:N because the code applies escapeshellcmd(), which blunts full arbitrary command execution down to constrained argument injection rather than clean shell takeover. Exploitation signals are mixed but consistent: a public exploit exists (VulDB gist, E:P), yet there is NO EPSS score and NO CISA KEV listing, so there is no evidence of widespread or automated exploitation - publicly available exploit code exists but that is distinct from active exploitation. The single-source origin (VulDB only, vendor unresponsive) and absence of an upstream patch mean version/fix data cannot be corroborated. Net: real and reproducible, but gated by authentication and partial mitigation, so LOW-to-MEDIUM operational priority.

An attacker with valid low-privilege access to the RaspAP web interface (or who has hijacked such a session) sends a crafted request to ajax/openvpn/del_ovpncfg.php with a malicious cfg_id value that slips past the incomplete escapeshellcmd() filtering. This injects attacker-controlled arguments/commands executed by the underlying OS as the web server user, potentially altering system behavior or disrupting the device. A public proof-of-concept exists (VulDB-linked gist), lowering the skill needed to reproduce it.