CVE-2026-75520— Domoticz: Missing authorization and path traversal in the udevices Lua parser handler

Quick assessment

Affected

domoticz domoticz

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Domoticz 是一款面向 Linux、Windows、macOS 和 Raspberry Pi 的免费开源家庭自动化系统。在 2026.3 版本之前， JSON 命令处理程序（位于中的函数）在调用 Lua 解析脚本之前，未执行任何权限检查，而其同类的命令处理程序均通过角色进行访问控制。因此，低权限的已认证用户可通过接口，利用攻击者控制的输入触发执行由管理员预先安装的 Lua 解析脚本。此外，参数也缺少针对的路径遍历防护：中的函数会将解析器目录与用户提供的脚本名称拼接生成文件名，随后将其传递给。

CVSS 5.4 · Medium Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Domoticz: Missing authorization and path traversal in the udevices Lua parser handler

Source: CVE Program / CVE List V5

Vulnerability Description

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights` check before invoking a Lua parser script, while its sibling command handlers gate access by role. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input through the `GET /json.htm` endpoint with `type=command` and `param=udevices`. The `script` parameter also lacked a `..` path-traversal guard: `CLuaHandler::executeLuaScript` in `main/LuaHandler.cpp` constructed the filename from the parser directory and the supplied script name before passing it to `luaL_loadfile`. Execution is limited to already-installed valid Lua files; this is not arbitrary code execution, and the advisory states that file-write and upload paths require administrator privileges. This issue is addressed in version 2026.3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
domoticz	domoticz	<= 2026.2	-

II. Public POCs for CVE-2026-75520

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-75520

请登录查看更多情报信息。

Other References for CVE-2026-75520 (5)

https://github.com/domoticz/domoticz/releases/tag/2026.3 x_refsource_MISC
https://github.com/domoticz/domoticz/security/advisories/GHSA-8rv5-x8wv-c5c4 x_refsource_CONFIRM
https://github.com/domoticz/domoticz/blob/2026.3/main/WebServerCmds.cpp#L3445-L3451 x_refsource_MISC
https://github.com/domoticz/domoticz/commit/73ed0495af6de3309f27cfc0091e803300ab5ccd x_refsource_MISC
https://github.com/domoticz/libwebem/blob/dfe946fa32f4c211662e47ef55b8cedfc50a6a76/include/libwebem/session.h#L10-L17 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-75520

IV. Related Vulnerabilities

Same product: domoticz

Same vendor: domoticz

Same weakness: CWE-22