CVE-2026-101858: RaspAP Webgui OS Command Injection RCE

CVE-2026-101858 Overview

CVE-2026-101858 is an operating system command injection vulnerability in RaspAP raspap-webgui versions up to 3.5.5. The flaw resides in the WiFiManager::writeWpaSupplicant function located in src/RaspAP/Networking/Hotspot/WiFiManager.php, part of the SSID Processing component. An authenticated attacker with high privileges can manipulate the ssid argument to inject arbitrary OS commands. The attack is initiated over the network. A public proof-of-concept exists, and the vendor did not respond to disclosure attempts. The weakness is classified under CWE-77 (Improper Neutralization of Special Elements Used in a Command).

Critical Impact
Authenticated remote attackers can inject arbitrary operating system commands through the SSID field, resulting in command execution in the context of the RaspAP web interface process.

Affected Products

RaspAP raspap-webgui versions up to and including 3.5.5
Component: SSID Processing (WiFiManager class)
File: src/RaspAP/Networking/Hotspot/WiFiManager.php

Discovery Timeline

2026-09-29 - CVE-2026-101858 published to the National Vulnerability Database
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-101858

Vulnerability Analysis

The vulnerability exists in the RaspAP web management interface, a widely used PHP application for configuring wireless access points on Raspberry Pi and similar Linux devices. The WiFiManager::writeWpaSupplicant function accepts a user-controlled ssid parameter and passes it into shell-level operations without sufficient neutralization of shell metacharacters. Because the SSID string is embedded into a command context used to write the wpa_supplicant configuration, attacker-controlled characters break out of the intended argument boundary. The function then executes attacker-supplied commands with the privileges of the RaspAP web process, which frequently has elevated rights to reconfigure networking.

Root Cause

The root cause is improper neutralization of special elements passed to an operating system command [CWE-77]. The ssid input is treated as trusted text when constructing shell operations for wpa_supplicant configuration. Metacharacters such as backticks, semicolons, and command substitution sequences are not filtered or escaped before reaching the command layer.

Attack Vector

Exploitation requires network reachability to the RaspAP web interface and authenticated access with high privileges. The attacker submits a crafted SSID value through the hotspot configuration workflow. When writeWpaSupplicant processes the value, the injected commands execute on the host. Because RaspAP typically runs on devices that manage wireless infrastructure, successful exploitation impacts the availability and integrity of downstream network services.

A public proof-of-concept is available at the GitHub Gist PoC. See the VulDB entry for CVE-2026-101858 for additional technical context. Synthetic exploitation code is not reproduced here.

Detection Methods for CVE-2026-101858

Indicators of Compromise

Unexpected entries in /etc/wpa_supplicant/wpa_supplicant.conf containing shell metacharacters such as ;, |, &, backticks, or $(...) sequences within the ssid field.
Web access logs showing authenticated POST requests to RaspAP hotspot configuration endpoints containing unusual SSID payloads.
Unexpected child processes spawned by the RaspAP web server user (for example www-data) shortly after SSID change requests.

Detection Strategies

Monitor process ancestry for shells (sh, bash) or interpreters launched as children of the PHP-FPM or web server process serving RaspAP.
Alert on writes to wpa_supplicant.conf that contain characters outside the printable SSID character set.
Inspect HTTP request bodies to RaspAP administration endpoints for command injection payloads targeting the ssid parameter.

Monitoring Recommendations

Enable authenticated access auditing on the RaspAP interface and correlate admin logins with subsequent configuration changes.
Forward RaspAP web server logs, authentication logs, and Linux process telemetry to a centralized analytics platform for correlation.
Track outbound network connections from the RaspAP host to detect post-exploitation command-and-control activity.

How to Mitigate CVE-2026-101858

Immediate Actions Required

Restrict network access to the RaspAP web interface to trusted management networks only, using host firewall rules or a management VLAN.
Rotate credentials for all RaspAP administrative accounts and enforce strong, unique passwords.
Audit wpa_supplicant.conf and RaspAP configuration files for signs of injected commands or unauthorized modifications.

Patch Information

No vendor patch has been published at the time of writing. The vendor was contacted but did not respond to the disclosure, according to the VulDB advisory for CVE-2026-101858. Track the upstream RaspAP project for updated releases beyond version 3.5.5.

Workarounds

Disable the hotspot configuration functionality if it is not required for the deployment.
Limit administrative accounts to the minimum necessary and remove high-privilege accounts that are not actively used.
Place the RaspAP host behind a reverse proxy that filters SSID parameter values and rejects requests containing shell metacharacters.
Run the RaspAP service under a least-privilege account and constrain its ability to modify networking with restrictive sudoers rules.

bash

# Example: restrict RaspAP web interface to a management subnet using iptables
iptables -A INPUT -p tcp --dport 80 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP