An escape-shell command injection flaw exists in the OpenVPN configuration handler of RaspAP raspap-webgui where a crafted cfg_id value allows an attacker to run arbitrary system commands on the host. The vulnerability can compromise confidentiality, integrity, and availability by enabling remote code execution if an attacker can submit the malicious cfg_id over HTTP. This weakness stems from improper sanitization in the escapeshellcmd function and is reflected in the CWE identifiers for command injection.

The flaw affects all installations of RaspAP raspap-webgui up to and including version 3.5.5. No other versions are currently documented as vulnerable.

The CVSS score of 5.3 indicates a medium severity level, while the EPSS score is 2%, suggesting a low but non-zero likelihood of exploitation. The vulnerability is listed as not being part of the CISA KEV catalog, but the public disclosure and the lack of a vendor response represent a significant operational risk. Exploitation can be achieved remotely by sending a crafted HTTP request containing a malicious cfg_id parameter to the del_ovpncfg.php endpoint, with no special privileges required beyond access to the web interface.