CVE-2026-101858

Name of the Vulnerable Software and Affected Versions RaspAP raspap-webgui versions prior to 3.5.6

Description An OS command injection flaw exists in the SSID Processing component. The issue occurs within the WiFiManager::writeWpaSupplicant() function located in the src/RaspAP/Networking/Hotspot/WiFiManager.php file. A remote attacker can trigger this by manipulating the ssid argument.

Recommendations Update RaspAP raspap-webgui to version 3.5.6 or later. As a temporary mitigation, restrict access to the SSID configuration settings to prevent unauthorized manipulation of the ssid argument.