CVE-2026-55159

Name of the Vulnerable Software and Affected Versions luci-app-adblock-fast versions prior to 1.2.4-2

Description The luci.adblock-fast.setCronEntry RPC method fails to properly sanitize the entry argument, allowing the inclusion of carriage-return or line-feed characters. These characters are serialized into /etc/crontabs/root as a single logical line, enabling an authenticated delegated user with the luci-app-adblock-fast write ACL to create an additional physical root cron entry via applications/luci-app-adblock-fast/root/usr/share/rpcd/ucode/luci.adblock-fast. This leads to persistent command execution as UID 0 (root) when the cron service runs.

Recommendations Update to version 1.2.4-2.