PT-2026-82517 · Undefined · Undefined

Ahmet Mersin

·

CVE-2026-26899

·

Published

2026-08-27

·

Updated

2026-09-01

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions luci-app-https-dns-proxy versions prior to 2026-01-17
Description Authenticated users can execute arbitrary shell commands due to improper handling of shell metacharacters in the name parameter within the setInitAction() function located in /usr/libexec/rpcd/luci.https-dns-proxy.
Recommendations Update luci-app-https-dns-proxy to a version released on or after 2026-01-17. As a temporary mitigation, restrict access to the setInitAction() function to prevent unauthorized command execution.

Exploit

Fix

OS Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-26899

Affected Products

Undefined