{"id":"CVE-2026-75520","kind":"vulnerability","aliases":["CVE-2026-75520"],"related":[],"title":"Domoticz: low-privilege users can run installed Lua parser scripts","description":"Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights` check before invoking a Lua parser script, while its sibling command handlers gate access by role. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input through the `GET /json.htm` endpoint with `type=command` and `param=udevices`. The `script` parameter also lacked a `..` path-traversal guard: `CLuaHandler::executeLuaScript` in `main/LuaHandler.cpp` constructed the filename from the parser directory and the supplied script name before passing it to `luaL_loadfile`. Execution is limited to already-installed valid Lua files; this is not arbitrary code execution, and the advisory states that file-write and upload paths require administrator privileges. This issue is addressed in version 2026.3.","summary":"Domoticz home automation server lets any logged-in user, including low-privilege accounts, trigger an existing operator-installed Lua parser script through the udevices command. A missing role check and a path traversal gap let the attacker choose which installed script runs and pass it attacker-controlled input, but it does not give arbitrary code execution.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["domoticz","home-automation","linux","macos","package","raspberry-pi","self-hosted","windows"],"not_affected_if":["auth-required","single-admin-user"],"how_to_check":"- Check the Domoticz version with `domoticz -version` or the version shown in the web UI; versions before `2026.3` are affected.\n- Look in the parser directory of the Domoticz install for Lua scripts; unknown whether any were installed by the operator.\n- Review user accounts for low-privilege users who can log in to the web interface.","fix":"- Upgrade Domoticz to `2026.3` or later.\n- Until upgraded, restrict web interface access to trusted users only.","status":"open","published_at":"2026-10-28T23:17:10+00:00","first_seen_at":"2026-10-28T23:35:49+00:00","triaged_at":"2026-10-28T23:36:43+00:00","updated_at":"2026-10-28T23:36:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T23:36:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Domoticz to `2026.3` or later.\n- Until upgraded, restrict web interface access to trusted users only.","reach":"network","title":"Domoticz: low-privilege users can run installed Lua parser scripts","impact":"medium","summary":"Domoticz home automation server lets any logged-in user, including low-privilege accounts, trigger an existing operator-installed Lua parser script through the udevices command. A missing role check and a path traversal gap let the attacker choose which installed script runs and pass it attacker-controlled input, but it does not give arbitrary code execution.","category":"package","nicknames":[],"who_cares":["domoticz","self-hosted","home-automation","linux","windows","macos","raspberry-pi"],"confidence":0.7,"needs_auth":"yes","worst_case":"Low-privilege user runs an installed Lua script with chosen input","analyst_note":"","how_to_check":"- Check the Domoticz version with `domoticz -version` or the version shown in the web UI; versions before `2026.3` are affected.\n- Look in the parser directory of the Domoticz install for Lua scripts; unknown whether any were installed by the operator.\n- Review user accounts for low-privilege users who can log in to the web interface.","needs_analyst":false,"not_affected_if":["auth-required","single-admin-user"],"who_is_affected":"Domoticz installations before 2026.3 where users with low-privilege accounts can reach the web interface. The risk depends on the operator having installed Lua parser scripts, since the attacker can only run files already present on disk. Installations with only administrator accounts or no untrusted logins are less exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000657,"input_tokens":3575,"output_tokens":600,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-75520':14A,17A '/json.htm':165C '2026.3':110C,241C 'access':136C 'account':46B 'address':238C 'administr':233C 'advisori':223C 'alreadi':210C 'already-instal':209C 'also':176C 'arbitrari':89B,218C 'attack':71B,81B,159C 'attacker-control':80B,158C 'authent':143C 'autom':21B,34B,99C 'check':63B,123C 'choos':72B 'cluahandl':183C 'cmd':116C 'code':90B,219C 'command':59B,114C,133C,169C 'construct':187C 'control':82B,160C 'could':145C 'cve':12A,15A 'directori':193C 'domoticz':1A,18B,32B,92C 'endpoint':166C 'execut':91B,147C,205C,220C 'executeluascript':184C 'exist':49B,150C 'file':214C,227C 'file-writ':226C 'filenam':189C 'free':95C 'gap':68B 'gate':135C 'get':164C 'give':88B 'guard':182C 'handler':115C,134C 'home':20B,33B,98C 'home-autom':19B 'host':30B 'includ':42B 'input':83B,161C 'instal':8A,52B,74B,153C,211C 'invok':125C 'issu':236C 'json':113C 'lack':177C 'let':36B,69B 'limit':207C 'linux':22B,102C 'loadfil':204C 'log':39B 'logged-in':38B 'low':3A,44B,141C 'low-privileg':2A,43B,140C 'lua':9A,53B,127C,154C,213C 'lual':203C 'maco':23B,104C 'main/luahandler.cpp':186C 'main/webservercmds.cpp':119C 'miss':61B 'name':198C 'open':96C 'oper':51B,152C 'operator-instal':50B,151C 'packag':24B 'param':171C 'paramet':175C 'parser':10A,54B,128C,155C,192C 'pass':78B,200C 'path':66B,180C,231C 'path-travers':179C 'perform':120C 'pi':27B,107C 'prior':108C 'privileg':4A,45B,142C,234C 'raspberri':26B,106C 'raspberry-pi':25B 'requir':232C 'role':62B,138C 'run':7A,76B 'script':11A,55B,75B,129C,156C,174C,197C 'self':29B 'self-host':28B 'server':35B 'session.rights':122C 'sibl':132C 'sourc':97C 'state':224C 'suppli':196C 'system':100C 'travers':67B,181C 'trigger':47B,146C 'type':168C 'udevic':58B,112C,172C 'updatedevic':117C 'upload':230C 'user':5A,41B,144C 'valid':212C 'version':240C 'window':31B,103C 'write':228C","nicknames":[],"mitigations":[],"who_affected":"Domoticz installations before 2026.3 where users with low-privilege accounts can reach the web interface. The risk depends on the operator having installed Lua parser scripts, since the attacker can only run files already present on disk. Installations with only administrator accounts or no untrusted logins are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T23:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-75520","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75520","severity":null,"published_at":"2026-10-28T23:17:10+00:00","modified_at":"2026-10-28T23:17:10+00:00","first_seen_at":"2026-10-28T23:35:49+00:00","fetched_at":"2026-10-28T23:35:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}