CVE-2026-101859

Name of the Vulnerable Software and Affected Versions RaspAP raspap-webgui versions prior to 3.5.6

Description An OS command injection flaw exists in the OpenVPN Configuration Handler component. The issue occurs within the escapeshellcmd() function located in the ajax/openvpn/del ovpncfg.php file. A remote attacker can exploit this by manipulating the cfg id argument to execute arbitrary operating system commands.

Recommendations Update RaspAP raspap-webgui to version 3.5.6 or later. As a temporary mitigation, restrict access to the ajax/openvpn/del ovpncfg.php file.