CVE-2026-101859: RaspAP raspap-webgui RCE Vulnerability

CVE-2026-101859 Overview

CVE-2026-101859 is an OS command injection vulnerability in RaspAP raspap-webgui versions up to 3.5.5. The flaw resides in the escapeshellcmd handling within ajax/openvpn/del_ovpncfg.php, part of the OpenVPN Configuration Handler component. Attackers can manipulate the cfg_id argument to inject arbitrary operating system commands. The attack is remotely exploitable and requires low-privileged authenticated access. Public exploit details have been disclosed, and the vendor did not respond to early disclosure attempts. This weakness is tracked under [CWE-77] (Improper Neutralization of Special Elements used in a Command).

Critical Impact

Authenticated remote attackers can inject operating system commands through the cfg_id parameter, potentially leading to unauthorized command execution on the RaspAP host.

Affected Products

• RaspAP raspap-webgui versions up to and including 3.5.5
• OpenVPN Configuration Handler component (ajax/openvpn/del_ovpncfg.php)
• Deployments exposing the RaspAP web interface to untrusted networks

Discovery Timeline

• 2026-09-29 - CVE-2026-101859 published to the National Vulnerability Database
• 2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-101859

Vulnerability Analysis

The vulnerability affects RaspAP, an open-source web interface used to configure wireless access points and OpenVPN services on Raspberry Pi and similar devices. The del_ovpncfg.php endpoint processes deletion requests for OpenVPN configuration profiles. It passes the user-supplied cfg_id value into an escapeshellcmd call before executing a shell command. Because escapeshellcmd sanitizes shell metacharacters but does not prevent argument injection, an attacker can append additional command arguments or options that alter the intended shell operation. Successful exploitation allows execution of attacker-controlled commands in the context of the web server process. Exploit details have been publicly disclosed, increasing the likelihood of opportunistic use against exposed instances.

Root Cause

The root cause is the use of escapeshellcmd as the sole defense when constructing a shell command from the cfg_id HTTP parameter. escapeshellcmd is designed to prevent command chaining, but it does not neutralize option-style arguments or values passed to invoked binaries. Combined with the absence of strict input validation, such as an allowlist of known configuration identifiers, the endpoint permits crafted values to influence command semantics.

Attack Vector

Exploitation occurs over the network by issuing a crafted request to the ajax/openvpn/del_ovpncfg.php endpoint. The attacker must possess valid low-privileged credentials to reach the endpoint. The malicious cfg_id value is delivered as part of the request body or query string. No user interaction is required beyond authentication. The vulnerability manifests when the server invokes the shell command constructed from the tainted argument.

A proof-of-concept has been shared publicly. See the GitHub Gist example and the VulDB entry for CVE-2026-101859 for technical specifics.

Detection Methods for CVE-2026-101859

Indicators of Compromise

• HTTP requests to ajax/openvpn/del_ovpncfg.php where the cfg_id parameter contains shell metacharacters, whitespace, or option-style values such as leading dashes.
• Unexpected child processes spawned by the RaspAP web server user, particularly shells, network utilities, or download commands.
• Modifications to OpenVPN configuration directories that do not correspond to authorized administrative actions.

Detection Strategies

• Inspect web server access logs for POST or GET requests to del_ovpncfg.php with anomalous cfg_id values that deviate from expected numeric or UUID formats.
• Correlate web request activity with process creation telemetry to identify command execution originating from the PHP handler.
• Deploy web application firewall rules that reject cfg_id values containing characters outside a strict allowlist.

Monitoring Recommendations

• Enable verbose logging on the RaspAP web interface and forward logs to a central platform for retention and search.
• Monitor outbound network connections from the RaspAP host for unexpected destinations that could indicate command execution.
• Alert on new persistence mechanisms such as cron jobs, systemd units, or SSH key additions on the affected device.

How to Mitigate CVE-2026-101859

Immediate Actions Required

• Restrict network access to the RaspAP web interface using firewall rules or VPN-only exposure until a patched release is available.
• Rotate credentials for all RaspAP users, particularly low-privileged accounts that can reach the OpenVPN endpoints.
• Audit the affected host for signs of prior exploitation, including unexpected processes, files, and outbound connections.

Patch Information

At the time of publication, no vendor patch has been referenced in the NVD entry, and the vendor did not respond to the reporter. Track the RaspAP project releases for a fixed version above 3.5.5 and apply it as soon as it becomes available. Refer to the VulDB vulnerability record #411093 for update information.

Workarounds

• Disable or remove the OpenVPN configuration management functionality if it is not required in the deployment.
• Place the RaspAP administrative interface behind an authenticating reverse proxy that enforces IP allowlisting and strict input validation on the cfg_id parameter.
• Restrict the web server account privileges so that any injected command executes with the minimum possible capabilities.

# Example: restrict access to the RaspAP web interface to a management subnet
sudo iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j DROP