Which versions of WGDashboard are affected by CVE-2026-44343?

WGDashboard versions before 4.3.2 contain an unauthenticated file access vulnerability (CVSS 9.3) that allows any remote attacker to read arbitrary server files without logging in, potentially…. A patch is available.

Is there a public PoC exploit available for CVE-2026-44343?

Yes, a public proof-of-concept exploit is available for CVE-2026-44343. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-44343?

Within 24 hours, inventory all WGDashboard instances and identify those running versions prior to 4.3.2. Within 7 days, upgrade all affected instances to WGDashboard 4.3.2 or later. Within 30 days, verify successful patch deployment across all systems and conduct file-access audit logs to detect any exploitation attempts prior to upgrade.

WGDashboard CVE-2026-44343

Q: What is the CVSS score of CVE-2026-44343?

CVE-2026-44343 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29732 CRITICAL

Improper Input Validation (CWE-20)

2026-05-12 GitHub_M

Authentication Bypass Wgdashboard

9.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable auth bypass exposing all admin functionality plus arbitrary file read, so PR:N/AC:L with full C/I/A impact; scope unchanged as the impact stays within the app host.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 22:14 vuln.today

Analysis Generated

Jul 23, 2026 - 22:14 vuln.today

Patch available

May 12, 2026 - 19:18 EUVD

CVSS changed

May 12, 2026 - 18:22 NVD

9.3 (CRITICAL)

CVE Published

May 12, 2026 - 16:39 nvd

CRITICAL 9.3

CVE Published

May 12, 2026 - 16:39 nvd

UNKNOWN (no severity yet)

DescriptionGitHub Advisory

WGDashboard is a dashboard for WireGuard VPN. Prior to 4.3.2, there are critical vulnerabilities affecting WGDashboard that, if exploited, could allow unauthorized parties to access the host file system without authentication. This vulnerability is fixed in 4.3.2.

AnalysisAI

Unauthenticated host file system access in WGDashboard before 4.3.2 lets remote attackers reach protected functionality and read arbitrary server files without logging in. The root cause is a broken authentication gate combined with an unauthenticated file-download endpoint that accepted attacker-controlled file paths. No public exploit identified at time of analysis, but the fixing commit is public and the flaw is trivially reachable, while EPSS remains low at 0.12%.

Technical ContextAI

WGDashboard is a Python/Flask web management console for WireGuard VPN. The vulnerability class is CWE-20 (Improper Input Validation), realized here as a flawed authentication whitelist and unsanitized path handling. The fixing commit (b15bbce) rewrites the auth_req() gate: the pre-4.3.2 check used substring matching (len(list(filter(lambda x : x not in request.path, whiteList)))), so any request path merely containing a whitelisted token bypassed the admin session check. It also removed the /fileDownload endpoint, which was whitelisted (no auth) and passed a raw file request argument into os.path.join('download', file)/send_file, enabling directory traversal, and hardened the backup download/delete handlers with os.path.basename(). The single affected CPE is cpe:2.3:a:wgdashboard:wgdashboard, confirming one product line.

RemediationAI

Vendor-released patch: 4.3.2 - upgrade WGDashboard to 4.3.2 or later immediately (fix commit b15bbce9bc5554ec379d558f032c730db47fcea2; advisory GHSA-rrf5-q4fp-qvgm). If you cannot patch right away, place WGDashboard behind an authenticating reverse proxy or VPN/network ACL so the web UI and its API are not reachable by untrusted clients, and block external access to the /fileDownload and backup download endpoints at the proxy layer; the trade-off is that legitimate remote administrators must first authenticate through the proxy, which may disrupt existing bookmarked/direct-access workflows. Restricting the dashboard to localhost or a management subnet is the most reliable compensating control until the upgrade is applied.