What is the CVSS score of EUVD-2026-54248?

EUVD-2026-54248 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of WGDashboard are affected by EUVD-2026-54248?

WGDashboard versions 4.3.2 and earlier are vulnerable to remote code execution that grants attackers full system compromise with root-level privileges; publicly available exploit code exists.

Is there a public PoC exploit available for EUVD-2026-54248?

Yes, a public proof-of-concept exploit is available for EUVD-2026-54248. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-54248?

Within 24 hours: Identify all WGDashboard instances running version 4.3.2 or earlier, prioritizing those exposed to the internet; immediately restrict network access to trusted internal networks only using firewall rules, or take systems offline if operationally feasible. Within 7 days: Contact WGDashboard vendor to confirm available patches or emergency security updates; if no patch is available within this timeframe, escalate to leadership for approval of extended containment strategy or initiate migration to alternative platforms. Within 30 days: Once vendor releases a patch, validate it in a test environment and deploy to all WGDashboard instances; alternatively, if vendor cannot provide a timely fix, complete migration to an alternative dashboard solution with active security support and establish continuous monitoring for template injection indicators in logs.

WGDashboard EUVD-2026-54248

| CVE-2026-15734 CRITICAL

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-08-06 cret@cert.org

GHSA-95wq-w6wp-f2w9

RCE Ssti

9.8

CVSS 3.1 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Description requires an authenticated attacker so PR:L (not PR:N); network-reachable web input with low complexity and no user interaction yields root-level code execution, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Threat Model Generated

Sep 01, 2026 - 15:34 vuln.today

Analysis Generated

Aug 07, 2026 - 17:22 vuln.today

CVSS changed

Aug 07, 2026 - 17:22 NVD

9.8 (CRITICAL)

CVE Published

Aug 06, 2026 - 22:16 cve.org

CRITICAL 9.8

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as root.

AnalysisAI

Remote code execution in WGDashboard 4.3.2 and earlier lets authenticated attackers inject Server-Side Template Injection payloads that execute arbitrary commands as root, giving full host compromise. Publicly available exploit code exists (Stuub's SSTI-to-Root-RCE PoC), though the flaw is not listed in CISA KEV and carries a low EPSS score of 0.28% (20th percentile), indicating no evidence of widespread automated exploitation yet. The combination of a working PoC and root-level impact makes this a high-priority patch target for any internet-exposed WGDashboard instance.

Technical ContextAI

WGDashboard is an open-source, Python/Flask-based web management panel for WireGuard VPN configurations. The root cause is CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine, i.e. Server-Side Template Injection): user-controlled input reaches the server-side template engine (typically Jinja2 in Flask stacks) without proper sanitization, allowing the attacker to break out of the template context and reach Python objects and OS command execution primitives. Because WGDashboard manages WireGuard - which requires elevated privileges to modify network interfaces - the service commonly runs as root, so template injection translates directly into root-level command execution. The EUVD entry (EUVD-2026-54248) and upstream repository at github.com/WGDashboard/WGDashboard identify the affected codebase; no CPE strings were supplied in the provided intelligence.

RemediationAI

No specific fixed version was included in the provided intelligence, so treat the fix status as 'No vendor-released patch version identified at time of analysis' and monitor the upstream repository (https://github.com/WGDashboard/WGDashboard) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-15734) for a tagged release above 4.3.2, then upgrade immediately once published. As compensating controls until a patched release is confirmed: restrict network access to the WGDashboard web interface to trusted management networks or a VPN/bastion only (do not expose it to the internet), enforce strong unique credentials and rotate any shared or default logins since exploitation requires an authenticated session, and place the dashboard behind a reverse proxy with authentication and rate limiting. Where feasible, run the WGDashboard service under a reduced-privilege account rather than root to blunt the impact of SSTI, accepting the trade-off that WireGuard interface management may then require carefully scoped sudo/capabilities configuration. Review web server and application logs for anomalous template-like payloads (e.g. sequences containing '{{', '{%', or Python object traversal strings) as a detection measure.