CVE-2026-59260

Name of the Vulnerable Software and Affected Versions luci-app-samba4 (affected versions not specified)

Description An issue in the luci-app-samba4 package occurs because read Access Control Lists (ACLs) grant file execution permissions on /usr/sbin/smbd. This allows authenticated delegated users to execute the Samba daemon using command-line arguments controlled by the caller. By injecting arbitrary Samba global options, such as the message command, an attacker can trigger command execution with root privileges when SMB protocol messages are processed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.