EUVD-2026-56042
GHSA-g5jq-gh88-3gmw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Authenticated clients.create user (PR:L) exploits a network-facing UI (AV:N/AC:L) and escapes the app to run commands as root on the host, a scope change (S:C) with full C/I/A impact.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file without neutralizing newline characters, allowing injection of arbitrary directives that are executed by wg-quick with root privileges. An attacker with clients.create permission achieves root code execution on the host.
AnalysisAI
Root-level OS command injection in wg-easy 15.3.0 lets a low-privileged web user holding the clients.create permission escalate to full host compromise. Because the client name is written verbatim into the WireGuard config, an attacker embeds newline-separated PostUp directives that wg-quick later executes as root. No public exploit identified at time of analysis, but the CVSS 9.9 (S:C, full C/I/A) and simple, GUI-driven injection make this a high-priority issue for any exposed wg-easy instance.
Technical ContextAI
wg-easy is a self-hosted web UI and management wrapper around WireGuard, generating and applying wg-quick configuration files. WireGuard config files support lifecycle hook directives such as PostUp/PostDown that run arbitrary shell commands when the interface is brought up. The affected component is cpe:2.3:a:wg-easy:wg-easy at version 15.3.0 (EUVD lists all versions up to and including 15.3.0). The root cause is CWE-78 (OS Command Injection): the client name field is serialized into the [Interface]/[Peer] config context without neutralizing newline characters, so a name containing a line break followed by 'PostUp = <cmd>' becomes a first-class config directive. wg-quick is typically run as root to manipulate network interfaces, so any injected PostUp command inherits root privileges.
RemediationAI
No vendor-released patch version is identified at time of analysis, so upgrade to a fixed release as soon as one is published on the wg-easy repository (https://github.com/wg-easy/wg-easy) - monitor its releases/security advisories, since EUVD-2026-56042 marks everything up to 15.3.0 as vulnerable. As compensating controls until a patch exists: restrict who holds the clients.create permission to fully trusted administrators only (the injection is only reachable by users with that grant), and audit existing client entries for names containing newlines or 'PostUp'/'PostDown' strings. Place the wg-easy management interface behind a VPN or IP allow-list rather than exposing it to the internet, and where feasible run wg-quick/wg-easy with reduced privileges or within a hardened container so an injected PostUp does not directly yield host root - noting that dropping privileges may break WireGuard interface management and require additional capability tuning. Validate/normalize client names on input as a stopgap if you maintain a local fork.
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today