CVE-2026-61875

Name of the Vulnerable Software and Affected Versions luci-app-upnp (affected versions not specified)

Description Stored cross-site scripting occurs when unauthenticated LAN clients inject JavaScript through UPnP IGD AddPortMapping SOAP requests. The issue arises because the NewPortMappingDescription field can contain malicious HTML, which is stored by miniupnpd and subsequently rendered by luci-app-upnp without output encoding. This allows the payload to execute when administrators access the UPnP or Status pages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.