CVE-2026-75520
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In Domoticz prior to 2026.3, the udevices JSON command handler (Cmd_UpdateDevices in main/WebServerCmds.cpp) performed no session.rights check before invoking a Lua parser script. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input via GET /json.htm, and the script parameter lacked a path-traversal guard. Execution is limited to already-installed valid Lua files, and the issue is addressed in version 2026.3.
Risk Assessment
A low-privilege authenticated user could trigger execution of an installed Lua script with controlled input, potentially leading to unexpected actions in the home automation system. The risk applies to Domoticz installations with multiple user accounts.
Recommendation
Update Domoticz to version 2026.3. Until updated, limit low-privilege accounts and monitor requests to /json.htm with the udevices parameter.
Other vulnerabilities in Domoticz
See all- CVE-2026-11425Medium
Domoticz versions prior to 2026.3 contain a stored cross-site scripting vulnerability in the mobile dashboard, allowing authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders data via ng-bind-html without proper escaping, enabling malicious payloads to execute in an administrator's browser.
- CVE-2026-71265High
Domoticz's MochadTCP::MatchLine handler for MOCHAD_RFSEC messages copies network-received data from the up-to-1028-byte m_mochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length check, across three separate code branches (DS10A/KR10A/MS10A device types).
- CVE-2026-1001Medium
Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality. An authenticated administrator can inject malicious code via crafted names containing script or HTML markup, which is stored and executed in the browsers of other users viewing the affected page.
Original NVD description (English source)
Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights` check before invoking a Lua parser script, while its sibling command handlers gate access by role. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input through the `GET /json.htm` endpoint with `type=command` and `param=udevices`. The `script` parameter also lacked a `..` path-traversal guard: `CLuaHandler::executeLuaScript` in `main/LuaHandler.cpp` constructed the filename from the parser directory and the supplied script name before passing it to `luaL_loadfile`. Execution is limited to already-installed valid Lua files; this is not arbitrary code execution, and the advisory states that file-write and upload paths require administrator privileges. This issue is addressed in version 2026.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS