- Son 7 gün
- CWE-22
- CWE-862
CVE-2026-75520
Domoticz: Missing authorization and path traversal in the udevices Lua parser handler
- Yayımlandı
- Güncellendi
- 29 Eki 2026
- Açık yaşı
- 0 gün
- Kaydı açan
- GitHub_M
Özet
Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.
Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the udevices JSON command handler, Cmd_UpdateDevices in main/WebServerCmds.cpp, performed no session.rights check before invoking a Lua parser script, while its sibling command handlers gate access by role. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input through the GET /json.htm endpoint with type=command and param=udevices. The script parameter also lacked a .. path-traversal guard: CLuaHandler::executeLuaScript in main/LuaHandler.cpp constructed the filename from the parser directory and the supplied script name before passing it to luaL_loadfile. Execution is limited to already-installed valid Lua files; this is not arbitrary code execution, and the advisory states that file-write and upload paths require administrator privileges. This issue is addressed in version 2026.3.
Etkilenen sürümler1 yazılım
| Yazılım | Etkilenen | Düzeltildiği sürüm |
|---|---|---|
| domoticz | ≤ 2026.2 | – |
Kaynaklar7 kaynak
- CVE.org kaydı
- NVD kaydı
- github.com/…moticz/security/advisories/GHSA-8rv5-x8wv-c5c4 Diğer
- github.com/…ommit/73ed0495af6de3309f27cfc0091e803300ab5ccd Diğer
- github.com/…cz/domoticz/blob/2026.3/main/WebServerCmds.cpp Diğer
- github.com/domoticz/domoticz/releases/tag/2026.3 Diğer
- github.com/…7ef55b8cedfc50a6a76/include/libwebem/session.h Diğer
Kayıt geçmişi
- Yayımlandı