Domoticz vulnerabilities

In Domoticz prior to 2026.3, the udevices JSON command handler (Cmd_UpdateDevices in main/WebServerCmds.cpp) performed no session.rights check before invoking a Lua parser script. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input via GET /json.htm, and the script parameter lacked a path-traversal guard. Execution is limited to already-installed valid Lua files, and the issue is addressed in version 2026.3.

Domoticz versions prior to 2026.3 contain a stored cross-site scripting vulnerability in the mobile dashboard, allowing authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders data via ng-bind-html without proper escaping, enabling malicious payloads to execute in an administrator's browser.

Domoticz's MochadTCP::MatchLine handler for MOCHAD_RFSEC messages copies network-received data from the up-to-1028-byte m_mochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length check, across three separate code branches (DS10A/KR10A/MS10A device types).

Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality. An authenticated administrator can inject malicious code via crafted names containing script or HTML markup, which is stored and executed in the browsers of other users viewing the affected page.