CVE-2026-1001: Domoticz < 2026.1 Stored XSS via Hardware Configuration Endpoint
Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality of the web interface that allows authenticated administrators to execute arbitrary scripts by supplying crafted names containing script or HTML markup. Attackers can inject malicious code that is stored and rendered without proper output encoding, causing script execution in the browsers of users viewing the affected page and enabling unauthorized actions within their session context.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Domoticzto a version that resolves this vulnerability.Fixed in 2026.1 - Compensating control
Temporarily restrict access to the Domoticz web interface so only trusted administrators can reach the Add Hardware and rename device functionality until you upgrade to 2026.1.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1001?
CVE-2026-1001 is classified as a high severity stored cross-site scripting vulnerability that affects Domoticz versions prior to 2026.1.
How do I fix CVE-2026-1001?
To fix CVE-2026-1001, upgrade to Domoticz version 2026.1 or later.
What components are affected by CVE-2026-1001?
CVE-2026-1001 affects the Add Hardware and rename device functionalities of the web interface in Domoticz.
Who can exploit CVE-2026-1001?
CVE-2026-1001 can be exploited by authenticated administrators who have access to the Domoticz web interface.
What kind of attack is possible with CVE-2026-1001?
CVE-2026-1001 allows attackers to execute arbitrary scripts within the context of the affected web interface, potentially leading to data theft or unauthorized actions.