Live › vulnerability › CVE-2026-75520
Go to dashboardDomoticz home automation server lets any logged-in user, including low-privilege accounts, trigger an existing operator-installed Lua parser script through the udevices command. A missing role check and a path traversal gap let the attacker choose which installed script runs and pass it attacker-controlled input, but it does not give arbitrary code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 23:35 UTC. All times on this page are UTC.
Domoticz installations before 2026.3 where users with low-privilege accounts can reach the web interface. The risk depends on the operator having installed Lua parser scripts, since the attacker can only run files already present on disk. Installations with only administrator accounts or no untrusted logins are less exposed.
No product ranges from the sources yet.
domoticz -version or the version shown in the web UI; versions before 2026.3 are affected.2026.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the udevices JSON command handler, Cmd_UpdateDevices in main/WebServerCmds.cpp, performed no session.rights check before invoking a Lua parser script, while its sibling command handlers gate access by role. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input through the GET /json.htm endpoint with type=command and param=udevices. The script parameter also lacked a .. path-traversal guard: CLuaHandler::executeLuaScript in main/LuaHandler.cpp constructed the filename from the parser directory and the supplied script name before passing it to luaL_loadfile. Execution is limited to already-installed valid Lua files; this is not arbitrary code execution, and the advisory states that file-write and upload paths require administrator privileges. This issue is addressed in version 2026.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-75520")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.