CVE-2026-75520

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights` check before invoking a Lua parser script, while its sibling command handlers gate access by role. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input through the `GET /json.htm` endpoint with `type=command` and `param=udevices`. The `script` parameter also lacked a `..` path-traversal guard: `CLuaHandler::executeLuaScript` in `main/LuaHandler.cpp` constructed the filename from the parser directory and the supplied script name before passing it to `luaL_loadfile`. Execution is limited to already-installed valid Lua files; this is not arbitrary code execution, and the advisory states that file-write and upload paths require administrator privileges. This issue is addressed in version 2026.3.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/domoticz/domoticz/blob/2026.3/main/WebServerCmds.cpp#L3445-L3451
https://github.com/domoticz/domoticz/commit/73ed0495af6de3309f27cfc0091e803300ab5ccd
https://github.com/domoticz/domoticz/releases/tag/2026.3
https://github.com/domoticz/domoticz/security/advisories/GHSA-8rv5-x8wv-c5c4
https://github.com/domoticz/libwebem/blob/dfe946fa32f4c211662e47ef55b8cedfc50a6a76/include/libwebem/session.h#L10-L17

Configurations

No configuration.

History

28 Oct 2026, 23:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-28 23:17

Updated : 2026-10-29 16:21

NVD link : CVE-2026-75520

Mitre link : CVE-2026-75520

CVE.ORG link : CVE-2026-75520

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-862

Missing Authorization

{"id": "CVE-2026-75520", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "domoticz", "product": "domoticz", "versions": [{"status": "affected", "version": "<= 2026.2"}]}]}], "published": "2026-10-28T23:17:10.537", "references": [{"url": "https://github.com/domoticz/domoticz/blob/2026.3/main/WebServerCmds.cpp#L3445-L3451", "source": "security-advisories@github.com"}, {"url": "https://github.com/domoticz/domoticz/commit/73ed0495af6de3309f27cfc0091e803300ab5ccd", "source": "security-advisories@github.com"}, {"url": "https://github.com/domoticz/domoticz/releases/tag/2026.3", "source": "security-advisories@github.com"}, {"url": "https://github.com/domoticz/domoticz/security/advisories/GHSA-8rv5-x8wv-c5c4", "source": "security-advisories@github.com"}, {"url": "https://github.com/domoticz/libwebem/blob/dfe946fa32f4c211662e47ef55b8cedfc50a6a76/include/libwebem/session.h#L10-L17", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights` check before invoking a Lua parser script, while its sibling command handlers gate access by role. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input through the `GET /json.htm` endpoint with `type=command` and `param=udevices`. The `script` parameter also lacked a `..` path-traversal guard: `CLuaHandler::executeLuaScript` in `main/LuaHandler.cpp` constructed the filename from the parser directory and the supplied script name before passing it to `luaL_loadfile`. Execution is limited to already-installed valid Lua files; this is not arbitrary code execution, and the advisory states that file-write and upload paths require administrator privileges. This issue is addressed in version 2026.3."}], "lastModified": "2026-10-29T16:21:34.310", "sourceIdentifier": "security-advisories@github.com"}