CVE-2026-72603

CVE-2026-72603 affects wg-easy 15.3.0. An OS command injection exists when newline-delimited WireGuard PostUp directives are injected into the client name field, which is written to the WireGuard configuration without neutralizing newlines. This allows an attacker with the clients.create permissi...

CVE-2026-72603 wg-easy wg-easy - OS Command Injection

An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file witho...

CVE-2026-72603: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file witho...