CVE-2026-75520

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-75520", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-17T20:49:21.599Z", "datePublished": "2026-10-28T22:30:59.693Z", "dateUpdated": "2026-11-03T13:49:20.705Z"}, "containers": {"cna": {"title": "Domoticz: Missing authorization and path traversal in the udevices Lua parser handler", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/domoticz/domoticz/security/advisories/GHSA-8rv5-x8wv-c5c4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/domoticz/domoticz/security/advisories/GHSA-8rv5-x8wv-c5c4"}, {"name": "https://github.com/domoticz/domoticz/commit/73ed0495af6de3309f27cfc0091e803300ab5ccd", "tags": ["x_refsource_MISC"], "url": "https://github.com/domoticz/domoticz/commit/73ed0495af6de3309f27cfc0091e803300ab5ccd"}, {"name": "https://github.com/domoticz/domoticz/blob/2026.3/main/WebServerCmds.cpp#L3445-L3451", "tags": ["x_refsource_MISC"], "url": "https://github.com/domoticz/domoticz/blob/2026.3/main/WebServerCmds.cpp#L3445-L3451"}, {"name": "https://github.com/domoticz/domoticz/releases/tag/2026.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/domoticz/domoticz/releases/tag/2026.3"}, {"name": "https://github.com/domoticz/libwebem/blob/dfe946fa32f4c211662e47ef55b8cedfc50a6a76/include/libwebem/session.h#L10-L17", "tags": ["x_refsource_MISC"], "url": "https://github.com/domoticz/libwebem/blob/dfe946fa32f4c211662e47ef55b8cedfc50a6a76/include/libwebem/session.h#L10-L17"}], "affected": [{"vendor": "domoticz", "product": "domoticz", "versions": [{"version": "<= 2026.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T22:30:59.693Z"}, "descriptions": [{"lang": "en", "value": "Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights` check before invoking a Lua parser script, while its sibling command handlers gate access by role. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input through the `GET /json.htm` endpoint with `type=command` and `param=udevices`. The `script` parameter also lacked a `..` path-traversal guard: `CLuaHandler::executeLuaScript` in `main/LuaHandler.cpp` constructed the filename from the parser directory and the supplied script name before passing it to `luaL_loadfile`. Execution is limited to already-installed valid Lua files; this is not arbitrary code execution, and the advisory states that file-write and upload paths require administrator privileges. This issue is addressed in version 2026.3."}], "source": {"advisory": "GHSA-8rv5-x8wv-c5c4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T13:48:51.680392Z", "id": "CVE-2026-75520", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T13:49:20.705Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-75520", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-03T13:48:51.680392Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T13:49:03.010Z"}}], "cna": {"title": "Domoticz: Missing authorization and path traversal in the udevices Lua parser handler", "source": {"advisory": "GHSA-8rv5-x8wv-c5c4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "domoticz", "product": "domoticz", "versions": [{"status": "affected", "version": "<= 2026.2"}]}], "references": [{"url": "https://github.com/domoticz/domoticz/security/advisories/GHSA-8rv5-x8wv-c5c4", "name": "https://github.com/domoticz/domoticz/security/advisories/GHSA-8rv5-x8wv-c5c4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/domoticz/domoticz/commit/73ed0495af6de3309f27cfc0091e803300ab5ccd", "name": "https://github.com/domoticz/domoticz/commit/73ed0495af6de3309f27cfc0091e803300ab5ccd", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/domoticz/domoticz/blob/2026.3/main/WebServerCmds.cpp#L3445-L3451", "name": "https://github.com/domoticz/domoticz/blob/2026.3/main/WebServerCmds.cpp#L3445-L3451", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/domoticz/domoticz/releases/tag/2026.3", "name": "https://github.com/domoticz/domoticz/releases/tag/2026.3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/domoticz/libwebem/blob/dfe946fa32f4c211662e47ef55b8cedfc50a6a76/include/libwebem/session.h#L10-L17", "name": "https://github.com/domoticz/libwebem/blob/dfe946fa32f4c211662e47ef55b8cedfc50a6a76/include/libwebem/session.h#L10-L17", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights` check before invoking a Lua parser script, while its sibling command handlers gate access by role. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input through the `GET /json.htm` endpoint with `type=command` and `param=udevices`. The `script` parameter also lacked a `..` path-traversal guard: `CLuaHandler::executeLuaScript` in `main/LuaHandler.cpp` constructed the filename from the parser directory and the supplied script name before passing it to `luaL_loadfile`. Execution is limited to already-installed valid Lua files; this is not arbitrary code execution, and the advisory states that file-write and upload paths require administrator privileges. This issue is addressed in version 2026.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T22:30:59.693Z"}}}, "cveMetadata": {"cveId": "CVE-2026-75520", "state": "PUBLISHED", "dateUpdated": "2026-11-03T13:49:20.705Z", "dateReserved": "2026-08-17T20:49:21.599Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-28T22:30:59.693Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "domoticz", "vendor": "domoticz", "versions": [{"status": "affected", "version": "<= 2026.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights` check before invoking a Lua parser script, while its sibling command handlers gate access by role. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input through the `GET /json.htm` endpoint with `type=command` and `param=udevices`. The `script` parameter also lacked a `..` path-traversal guard: `CLuaHandler::executeLuaScript` in `main/LuaHandler.cpp` constructed the filename from the parser directory and the supplied script name before passing it to `luaL_loadfile`. Execution is limited to already-installed valid Lua files; this is not arbitrary code execution, and the advisory states that file-write and upload paths require administrator privileges. This issue is addressed in version 2026.3."}], "id": "CVE-2026-75520", "lastModified": "2026-11-03T14:17:37.643", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75520", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T13:48:51.680392Z", "version": "2.0.3"}}]}, "published": "2026-10-28T23:17:10.537", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/domoticz/domoticz/blob/2026.3/main/WebServerCmds.cpp#L3445-L3451"}, {"source": "security-advisories@github.com", "url": "https://github.com/domoticz/domoticz/commit/73ed0495af6de3309f27cfc0091e803300ab5ccd"}, {"source": "security-advisories@github.com", "url": "https://github.com/domoticz/domoticz/releases/tag/2026.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/domoticz/domoticz/security/advisories/GHSA-8rv5-x8wv-c5c4"}, {"source": "security-advisories@github.com", "url": "https://github.com/domoticz/libwebem/blob/dfe946fa32f4c211662e47ef55b8cedfc50a6a76/include/libwebem/session.h#L10-L17"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "domoticz: domoticz: Unauthorized script execution via missing permission checks", "id": "2563234", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563234"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-425", "details": ["Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights` check before invoking a Lua parser script, while its sibling command handlers gate access by role. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input through the `GET /json.htm` endpoint with `type=command` and `param=udevices`. The `script` parameter also lacked a `..` path-traversal guard: `CLuaHandler::executeLuaScript` in `main/LuaHandler.cpp` constructed the filename from the parser directory and the supplied script name before passing it to `luaL_loadfile`. Execution is limited to already-installed valid Lua files; this is not arbitrary code execution, and the advisory states that file-write and upload paths require administrator privileges. This issue is addressed in version 2026.3.", "A flaw was found in Domoticz. Missing authorization checks allow low-privileged authenticated users to execute existing server scripts with attacker-controlled input. The application's device update command handler fails to validate user permissions before invoking Lua scripts and does not properly restrict script file paths. A remote authenticated attacker can exploit this issue by submitting a crafted web request, resulting in unauthorized script execution and potential data modification."], "name": "CVE-2026-75520", "public_date": "2026-10-28T22:30:59Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-75520\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-75520\nhttps://github.com/domoticz/domoticz/blob/2026.3/main/WebServerCmds.cpp#L3445-L3451\nhttps://github.com/domoticz/domoticz/commit/73ed0495af6de3309f27cfc0091e803300ab5ccd\nhttps://github.com/domoticz/domoticz/releases/tag/2026.3\nhttps://github.com/domoticz/domoticz/security/advisories/GHSA-8rv5-x8wv-c5c4\nhttps://github.com/domoticz/libwebem/blob/dfe946fa32f4c211662e47ef55b8cedfc50a6a76/include/libwebem/session.h#L10-L17"], "statement": "This vulnerability is rated as Moderate severity because exploitation requires an existing authenticated session with network reachability, and execution is strictly confined to pre-installed Lua scripts on the server rather than permitting arbitrary code execution. Domoticz is not included or supported in Red Hat Enterprise Linux, limiting exposure to Fedora community packages. Consequently, enterprise environments running supported Red Hat products are not affected by this flaw.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2026.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "domoticz", "source": "cna", "vendor": "domoticz"}, "product": "domoticz", "vendor": "domoticz"}], "created": "2026-10-28T23:30:09.166453+00:00", "updated": "2026-10-31T02:15:16.420829+00:00", "vendors": ["domoticz", "domoticz$PRODUCT$domoticz"]}