Which versions of luci-app-travelmate are affected by EUVD-2026-41366?

OpenWrt's luci-app-travelmate (versions 2.4.5-r3 and 2.4.6-1) contains an authenticated privilege escalation vulnerability allowing users with limited web interface write access to execute arbitrary…. A patch is available.

How to fix or mitigate EUVD-2026-41366?

24 hours: Audit all OpenWrt deployments running luci-app-travelmate versions 2.4.5-r3 and 2.4.6-1. 7 days: Apply available vendor patch to all affected systems and verify deployment. 30 days: Review and restrict luci-app-travelmate write ACL to authorized administrators only; document all patched instances.

luci-app-travelmate EUVD-2026-41366

Q: What is the CVSS score of EUVD-2026-41366?

EUVD-2026-41366 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-58652 HIGH

OS Command Injection (CWE-78)

2026-07-02 VulnCheck

GHSA-x6j4-vgjq-5839

Command Injection Openwrt Travelmate Luci App Travelmate

7.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.5 HIGH

Network-reachable via LuCI/rpcd but needs an existing delegated write ACL (PR:L) and the auto-login branch to fire (AC:H); escalating a scoped ACL to root crosses an authority boundary (S:C) with full root impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 13:16 vuln.today

DescriptionCVE.org

luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. While the LuCI UI restricts the auto-login script picker to /etc/travelmate/*.login, this is only a frontend restriction. The backend travelmate service (running as root) reads the raw UCI 'script' and 'script_args' values and executes the configured path when the captive-portal auto-login branch (f_check() in travelmate-functions.sh) is reached. An attacker with delegated write permissions can set script to /bin/sh and script_args to attacker-controlled arguments, resulting in arbitrary command execution as root. Confirmed in luci-app-travelmate/travelmate 2.4.5-r3; the sink is still present in travelmate 2.4.6-1 and no patched version is known.

AnalysisAI

Root-level command injection in OpenWrt's luci-app-travelmate/travelmate (confirmed in 2.4.5-r3, sink still present in 2.4.6-1) lets an rpcd/LuCI session holding only the luci-app-travelmate write ACL escalate to arbitrary command execution as root. The LuCI UI limits the auto-login script picker to /etc/travelmate/*.login, but that is a frontend-only check: the root-run backend reads the raw UCI 'script' and 'script_args' values, so an attacker sets script to /bin/sh with controlled arguments to run commands as root when the captive-portal auto-login branch fires. Reported by VulnCheck with no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

Travelmate is an OpenWrt package that automates Wi-Fi uplink management and captive-portal handling on travel/router deployments, driven by UCI configuration and exposed for administration through LuCI over rpcd. The affected components per CPE are cpe:2.3:a:openwrt:luci-app-travelmate and cpe:2.3:a:openwrt:travelmate. The root cause is CWE-78 (OS Command Injection): travelmate-functions.sh f_check() reaches an auto-login branch that reads the UCI 'script' and 'script_args' fields and executes the referenced path directly as root, without validating that the path stays within the intended /etc/travelmate/*.login allowlist. Because the daemon trusts values that a delegated LuCI/rpcd ACL can write, the security boundary between a scoped write permission and root process execution is broken - a classic frontend-restriction-vs-backend-sink mismatch.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the fixes referenced in the GHSA advisory (https://github.com/openwrt/luci/security/advisories/GHSA-p35r-3323-6g7g) via the openwrt/luci commits f85102548ee8325bfd581a0327b210b5f7670829, 491f1df06645c4e0757fed4a9f0622e9ce0d300c, 71d92bcc9edbc8f95858ce82a8ff5d52500005a2, 0627b412ee3a760cc4bca9fc8a5b73de8f33ac10, and d6e457a1a70a9010195edeafdc0b8eb6e3b0f7f1, or rebuild the package from a source tree containing them, since the description indicates no tagged release is yet confirmed clean (2.4.6-1 still vulnerable). Until a patched build is deployed, revoke or avoid granting the luci-app-travelmate write ACL to any non-trusted rpcd/LuCI account (trade-off: those users lose travelmate configuration ability), and disable the captive-portal auto-login feature so the f_check() sink is never reached (trade-off: manual captive-portal login required). As a hardening step, validate or pin the UCI 'script' value to a fixed known-good path outside operator control and monitor changes to the travelmate 'script'/'script_args' UCI keys.