CVE-2026-44343 WGDashboard: Critical Vulnerability in 4.3.2
Unauthenticated attackers can access the host file system due to improper input validation in WGDashboard.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-44343?
CVE-2026-44343 is a critical path traversal vulnerability in WGDashboard, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WGDashboard is a dashboard for WireGuard VPN. Prior to 4.3.2, there are critical vulnerabilities affecting WGDashboard that, if exploited, could allow unauthorized parties to access the host file system without authentication. This vulnerability is fixed in 4.3.2.
Weakness: CWE-20
Which versions are affected by CVE-2026-44343?
It affects 1 product.
Products include Wgdashboard Wgdashboard.
How do I fix CVE-2026-44343?
No fix has been published for CVE-2026-44343 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-44343 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44343 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-rrf5-q4fp-qvgm.