CVE-2026-15734
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3.2 and earlier allows authenticated attackers to execute arbitrary code as root.
Risk Assessment
The risk for the organization includes complete compromise of the server running WGDashboard, which could lead to confidentiality, integrity, and availability breaches, as well as further attacks within the network.
Recommendation
It is recommended to immediately update WGDashboard to the latest version that does not contain this vulnerability, and restrict access to the dashboard to trusted users only.
Other vulnerabilities in WGDashboard
See all- CVE-2026-15733Critical
A Remote Code Execution (RCE) vulnerability exists in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root.
- CVE-2026-15732Critical
A Server-Side Request Forgery (SSRF) vulnerability exists in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses.
- CVE-2026-44343Critical
WGDashboard, a dashboard for managing WireGuard VPN, prior to version 4.3.2 had critical vulnerabilities that could allow unauthorized parties to access the host file system without authentication.
Original NVD description (English source)
A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as root.