Read the docs
TI-2026-82248 Aliases CVE-2026-75520

Missing authorization and path traversal in Domoticz udevices command

Priority LOW 24CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Domoticz through 2026.2 is affected. The udevices command handler does not check user rights before it runs an installed Lua parser script, and the script name lacks a guard against path traversal (CWE-22). An authenticated user with low privileges can run an existing parser script with attacker-controlled input, but cannot execute arbitrary code.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights` check before invoking a Lua parser script, while its sibling command handlers gate access by role. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input through the `GET /json.htm` endpoint with `type=command` and `param=udevices`. The `script` parameter also lacked a `..` path-traversal guard: `CLuaHandler::executeLuaScript` in `main/LuaHandler.cpp` constructed the filename from the parser directory and the supplied script name before passing it to `luaL_loadfile`. Execution is limited to already-installed valid Lua files; this is not arbitrary code execution, and the advisory states that file-write and upload paths require administrator privileges. This issue is addressed in version 2026.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00279 20th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Domoticzdomoticzup to 2026.2—No fix listedCNA
  • domoticz VendorDomoticz Affected up to 2026.2 Fixed in — No fix listed CNA

Remediation

Upgrade Domoticz to version 2026.3, which addresses this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-75520
  2. 2026-10-30 Priority changed: MEDIUM → LOW
  3. 2026-10-30 Affected versions changed · Red Hat
  4. 2026-10-30 CVSS score added · Red Hat
  5. 2026-11-03 CISA SSVC decision points changed

References

Other 5

  • TI-2019-07959 Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp. CVSS 3.0CRITICAL 9.8
  • TI-2019-07971 Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options. CVSS 3.0HIGH 7.5
  • TI-2020-14215 Emmanuel MyDomoAtHome (MDAH) REST API REST API Domoticz ISS Gateway 0.2.40 is affected by… CVSS 3.1HIGH 7.5
  • TI-2026-49933 Domoticz MochadTCP Stack Buffer Overflow via MOCHAD_RFSEC strcpy() CVSS 3.1HIGH 7.5
  • TI-2019-11584 Domoticz 4.10717 has XSS via item.Name. CVSS 3.0MEDIUM 5.4
  • TI-2026-00755 Domoticz < 2026.1 Stored XSS via Hardware Configuration Endpoint CVSS 4.0MEDIUM 4.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences