CVE-2026-75520

Name of the Vulnerable Software and Affected Versions Domoticz versions prior to 2026.3

Description The udevices JSON command handler, Cmd UpdateDevices in main/WebServerCmds.cpp, fails to perform a session.rights check before invoking a Lua parser script. A low-privilege authenticated user can trigger the execution of an existing operator-installed Lua parser script using attacker-controlled input via the GET /json.htm endpoint with type=command and param=udevices. Additionally, the script parameter lacks a path-traversal guard in CLuaHandler::executeLuaScript within main/LuaHandler.cpp, which constructs the filename from the parser directory and the supplied script name before passing it to luaL loadfile. Execution is limited to previously installed valid Lua files.

Recommendations Update to version 2026.3.