# CVE-2026-101859: RaspAP raspap-webgui OS command injection in OpenVPN configuration handler

Source: https://junglewise.ai/threats/cve-2026-101859-a-vulnerability-has-been-found-in-raspap-raspap-webgui-up-to-3-5  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-101859 · Severity: medium · CVSS 5.4 · Published 2026-09-29

RaspAP is a web-based interface for configuring and managing WiFi and network settings on Raspberry Pi devices. An attacker can remotely inject arbitrary operating system commands through the OpenVPN configuration deletion function, allowing code execution with the privileges of the web server. This could lead to unauthorized access, system compromise, or lateral movement to gain root-level control.

Technologies: [Raspap-Webgui](https://junglewise.ai/threats/technologies/raspap-webgui). Vendors: [RaspAP](https://junglewise.ai/threats/vendors/raspap).

## Quick answers

**Is CVE-2026-101859 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101859 being exploited in the wild.

**How severe is CVE-2026-101859?** Medium severity, with a CVSS score of 5.4, published 29 September 2026.

**Which products and versions are affected?** Raspap-Webgui up to 3.5.5.

**Is there a fix for CVE-2026-101859?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-101859 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-101859?** Check whether you run Raspap-Webgui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the ajax/openvpn/del_ovpncfg.php endpoint's escapeshellcmd function, which insufficiently sanitizes the cfg_id parameter before passing it to shell execution. An authenticated attacker can craft a malicious cfg_id value to inject arbitrary OS commands that execute as the www-data user. Privilege escalation chains to root access have been demonstrated via plugin_helper.sh and sudoers misconfiguration.

## Affected products

- RaspAP raspap-webgui up to 3.5.5

## Timeline

- 2026-09-29: disclosed: Public disclosure
- 2026-08-15: exploited: Working end-to-end PoC published

## References

- [https://gist.github.com/simyat/10422042d6d5225b2beb87754de4b68c](https://gist.github.com/simyat/10422042d6d5225b2beb87754de4b68c)
- [https://vuldb.com/cve/CVE-2026-101859](https://vuldb.com/cve/CVE-2026-101859)

## Related threats

- [RaspAP raspap-webgui improper privilege management in sudo configuration](https://junglewise.ai/threats/cve-2026-101860-a-vulnerability-was-found-in-raspap-raspap-webgui-up-to-3-5-5)
- [RaspAP raspap-webgui OS command injection in SSID processing](https://junglewise.ai/threats/cve-2026-101858-a-flaw-has-been-found-in-raspap-raspap-webgui-up-to-3-5-5)