CVE-2026-15733CWE-78command-injection

CVE-2026-15733

Critical · published August 7, 2026

CVSS v3.1

9.8

EPSS

10%

Percentile

95.6

In the wild

Unconfirmed

What it is

A Remote Code Execution (RCE) vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root.

The record

Technical detail

CVSS v3.1: 9.8 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.10020 · 95.6th percentile
Weakness: CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2026-08-07T02:16Z

References (3)

https://github.com/Stuub/WGDashboard-v4.3.2-OS-Command-Injection-to-Root-RCE-PoC · [email protected]https://github.com/WGDashboard/WGDashboard · [email protected]https://github.com/Stuub/WGDashboard-v4.3.2-OS-Command-Injection-to-Root-RCE-PoC · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

06 AUG 20:00Z
WGDashboard Remote Code Execution vulnerability
cvelistv5