Zwcrazythursday

**Name of the Vulnerable Software and Affected Versions** luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker rpc.uc RPC backend) **Description** An OS command injection issue exists where the read ACL grants broad ubus access to docker.* and docker.container.*, exposing the `docker.container.ttyd start` method. The `run ttyd` handler constructs a shell command using the `id`, `cmd`, and `uid` variables from the request and passes it to the `system()` function without proper quoting or argv-style execution in the rpcd root context. An authenticated attacker with read ACL permissions can inject shell metacharacters into these variables, such as `id`, to execute arbitrary commands as root via an HTTP POST request to the `/ubus` endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** luci-app-samba4 (affected versions not specified) **Description** An issue in the luci-app-samba4 package occurs because read Access Control Lists (ACLs) grant file execution permissions on `/usr/sbin/smbd`. This allows authenticated delegated users to execute the Samba daemon using command-line arguments controlled by the caller. By injecting arbitrary Samba global options, such as the message command, an attacker can trigger command execution with root privileges when SMB protocol messages are processed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** luci-app-travelmate versions 2.4.5-r3 through 2.4.6-1 travelmate versions 2.4.5-r3 through 2.4.6-1 **Description** A privilege-escalation flaw exists where a LuCI/rpcd session with write ACL for luci-app-travelmate is granted config-wide UCI write access to the travelmate configuration. Although the user interface restricts the auto-login script selection to /etc/travelmate/*.login, this is only a frontend restriction. The backend travelmate service, which runs as root, reads the raw UCI `script` and `script args` values and executes the path when the captive-portal auto-login branch `f check()` in travelmate-functions.sh is reached. An attacker with delegated write permissions can change `script` to /bin/sh and provide controlled arguments in `script args` to execute arbitrary commands as root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.