CVE-2026-75520: Domoticz: Missing authorization and path traversal in the udevices Lua parser handler
Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the udevices JSON command handler, CmdUpdateDevices in main/WebServerCmds.cpp, performed no session.rights check before invoking a Lua parser script, while its sibling command handlers gate access by role. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input through the GET /json.htm endpoint with type=command and param=udevices. The script parameter also lacked a .. path-traversal guard: CLuaHandler::executeLuaScript in main/LuaHandler.cpp constructed the filename from the parser directory and the supplied script name before passing it to luaLloadfile. Execution is limited to already-installed valid Lua files; this is not arbitrary code execution, and the advisory states that file-write and upload paths require administrator privileges. This issue is addressed in version 2026.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Domoticzto a version that resolves this vulnerability.Fixed in 2026.3
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privilege authenticated Domoticz user can exploit it through the GET /json.htm endpoint using type=command and param=udevices. No user interaction is required.
What does an attacker need to execute through the vulnerable handler?
The attacker needs an existing, valid Lua parser script already installed on the system and can supply attacker-controlled input to it. The issue does not provide arbitrary code execution because upload and file-write paths require administrator privileges.
Are installations using default role protections affected?
The affected udevices handler did not check session.rights before invoking the Lua parser, unlike sibling command handlers that enforce role-based access. As a result, low-privilege authenticated accounts could access functionality intended to be role-gated.
How can path traversal be used here?
The script parameter was used to construct a filename without rejecting .. path components before Lua loaded the file. Execution remains limited to valid Lua files reachable through that path handling.
What version fixes the issue?
Domoticz version 2026.3 addresses the missing authorization check and the path-traversal handling.