Description

A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as root.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-06T22:16:48.513Z",
  "pubdate": "2026-08-06T22:16:48.513Z",
  "executiveSummary": "An authenticated Server-Side Template Injection (SSTI) vulnerability exists in WGDashboard version 4.3.2 and earlier. This security flaw enables authenticated attackers to execute arbitrary system code with root privileges on the underlying host operating system.\nThe vulnerability exposes the affected product to critical remote code execution risks, severely compromising the confidentiality, integrity, and availability of the host server and associated WireGuard VPN network configurations.\nExploitation of this vulnerability requires valid user credentials to access the vulnerable application interface, granting the attacker the ability to interact with dynamic template rendering engines improperly.\nThe risk implication is catastrophic due to the escalation to root-level privileges, which allows complete system takeover, unauthorized access to sensitive cryptographic material, and potential pivoting into protected network segments managed by the WireGuard dashboard.\nOrganizations deploying vulnerable instances must restrict access and apply available vendor updates immediately to prevent full administrative compromise of the underlying infrastructure.",
  "technicalDetails": "The vulnerability resides in WGDashboard version 4.3.2 and earlier within components responsible for processing user-supplied input inside server-side template engines. The root cause is the insecure handling and direct evaluation of untrusted dynamic data without proper sanitization, contextual escaping, or sandboxing mechanisms.\nAttack flow begins with an authenticated attacker submitting maliciously crafted template syntax payload strings through application input parameters exposed via the web interface. Because the vulnerable component passes this raw input directly to the template evaluation engine, the underlying backend executes the injected directives.\nDue to the execution context of the application, the resultant code execution inherits root-level privileges. This permits the attacker to execute arbitrary operating system commands, read sensitive system files, manipulate network interface configurations, and establish persistent access mechanisms.\nPrerequisites for successful exploitation include network access to the application interface and valid authentication credentials. However, the severity is amplified by the fact that standard administrative or low-privilege sessions can leverage the SSTI primitive to escalate privileges entirely to root.\nPost-exploitation impact encompasses total system compromise, interception of VPN traffic parameters, modification of firewall and routing rules, and potential lateral movement across connected internal network environments managed by the compromised WireGuard service."
}