CVE-2026-55897

Name of the Vulnerable Software and Affected Versions luci-app-advanced-reboot versions prior to 1.1.2-6

Description An issue exists where the read Access Control List (ACL) in the file applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json grants rpcd the file.exec permission for the /bin/sh shell interpreter. An authenticated delegated session with this ACL can provide caller-controlled parameters. Because rpcd authorizes the executable path and passes these arguments to the shell, it allows for the execution of arbitrary commands with root privileges.

Recommendations Update to version 1.1.2-6.