RaspAP raspap-webgui Command Injection and Privilege Escalation

Improper privilege management in RaspAP WebGUI through 3.5.5 lets an authenticated low-privilege web-UI user escalate to root by manipulating how the plugin installer writes sudo configuration entries through PluginInstaller::addSudoers (src/RaspAP/Plugins/PluginInstaller.php). Exploitation is remote and unauthenticated attempts are not possible - the attacker must already hold a valid RaspAP panel session (CVSS 4.0 PR:L, independently assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H) - but no user interaction or unusual complexity is required beyond that. Publicly available exploit code exists (a GitHub gist demonstration was published alongside the VulDB entry), and the vendor was contacted but did not respond, so no vendor-released patch has been identified at time of analysis; this is a genuine high-impact issue but not an emergency, with exposure concentrated on panels reachable from untrusted networks or protected only by default credentials.

OS command injection in RaspAP's raspap-webgui (raspap-webgui through version 3.5.5) lets an attacker who already holds a low-privileged authenticated session manipulate the cfg_id parameter of ajax/openvpn/del_ovpncfg.php to inject extra arguments/commands through the incomplete escapeshellcmd() filter. The flaw is remote but requires a valid session (CVSS 4.0 AV:N/AC:L/PR:L/UI:N, assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), and because escapeshellcmd only neutralizes shell metacharacters rather than argument boundaries, the realistic outcome is constrained argument injection affecting integrity and availability rather than unrestricted remote code execution. Publicly available exploit code exists (a referenced GitHub gist), but there is no indication of confirmed active exploitation (CISA KEV); the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.

OS command injection in RaspAP's raspap-webgui component (versions up to and including 3.5.5) lets an authenticated, high-privilege RaspAP administrator execute arbitrary operating-system commands on the host by manipulating the SSID value that WiFiManager::writeWpaSupplicant writes into the wpa_supplicant configuration. Exploit code has been published publicly and may be used, so the technical details are already circulating, although there is no confirmation of active exploitation (the CVE is not in CISA KEV). Impact is web-admin-to-host-OS escalation rather than external compromise, since valid administrative web GUI credentials are a hard prerequisite; the vendor was contacted early about the disclosure but did not respond, and no vendor-released patched version has been identified.