Domoticz EUVD-2026-112548

Requires a valid low-privilege authenticated Domoticz account with at least SWITCHER rights (rights=1) on Domoticz 2026.2 or earlier; VIEWER/NONE accounts are rejected by the fix and anonymous access does not apply. Exploitation further requires that an operator has already installed a valid Lua parser script in the parser directory, since execution is limited to pre-existing valid .lua files loaded via luaL_loadfile - there is no low-privilege code-plant because all file-write and upload paths are ADMIN-gated. The secondary '..' path traversal only broadens reachable filenames to other existing valid Lua files and cannot introduce new code. These factors - mandatory authentication, dependence on operator-provisioned scripts, and the no-arbitrary-execution ceiling - substantially limit realistic impact below what the network vector alone suggests.

This is a genuine but moderate-severity authorization flaw, not a critical one. The CVSS 3.1 base score is 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, confirmed identically by both NVD and the vendor GHSA advisory. The network vector and low complexity are real, but PR:L means a valid low-privilege authenticated account (SWITCHER, rights=1) is required - this is not a pre-auth issue. No EPSS score was provided and the CVE is not in CISA KEV, so there is no signal of active or widespread exploitation; the vuln.today decision label is 'this_month', i.e. routine patch prioritization rather than emergency. No SSVC decision fields (automatable, technical impact) were supplied. Critically, the real-world impact is bounded: the advisory and root-cause analysis state explicitly that this is NOT arbitrary code execution - execution is limited to an already-installed, operator-provisioned, valid Lua parser script, every file-write/upload path remains ADMIN-gated, and the secondary path traversal can only reach pre-existing valid Lua files that luaL_loadfile will accept. The practical worst case is a low-privilege user invoking a trusted parser with attacker-controlled input that was intended to require a higher role. Note a conflict in the input metadata: it is tagged 'RCE', but the primary source (GHSA-8rv5-x8wv-c5c4) directly contradicts this. Treat the 'RCE' label as inaccurate.

An attacker holding a low-privilege Domoticz account (SWITCHER role) sends GET /json.htm?type=command&param=udevices&script=<name> to invoke an operator-installed Lua parser script that the sibling handlers would have gated behind a higher role, feeding it attacker-controlled device input. No public working exploit code was identified in the provided sources; only the vendor advisory, patch commit, and release are referenced. Because AV:N/AC:L apply, the request is a single straightforward authenticated HTTP call, but the outcome is limited to behavior of an already-present trusted script, not new code execution.