---
id: CVE-2026-75520
title: >-
  Domoticz: Missing authorization and path traversal in the udevices Lua parser
  handler
summary: >-
  Domoticz is a free, open source home automation system for Linux, Windows,
  macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler,
  `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights`
  chec…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-22
  - CWE-862
vendor: domoticz
product: domoticz
affected:
  - domoticz <= 2026.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T13:48:51.680392Z'
published: '2026-10-28'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T13:49:20.705Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-75520'
references:
  - url: >-
      https://github.com/domoticz/domoticz/security/advisories/GHSA-8rv5-x8wv-c5c4
    label: >-
      https://github.com/domoticz/domoticz/security/advisories/GHSA-8rv5-x8wv-c5c4
  - url: >-
      https://github.com/domoticz/domoticz/commit/73ed0495af6de3309f27cfc0091e803300ab5ccd
    label: >-
      https://github.com/domoticz/domoticz/commit/73ed0495af6de3309f27cfc0091e803300ab5ccd
  - url: >-
      https://github.com/domoticz/domoticz/blob/2026.3/main/WebServerCmds.cpp#L3445-L3451
    label: >-
      https://github.com/domoticz/domoticz/blob/2026.3/main/WebServerCmds.cpp#L3445-L3451
  - url: 'https://github.com/domoticz/domoticz/releases/tag/2026.3'
    label: 'https://github.com/domoticz/domoticz/releases/tag/2026.3'
  - url: >-
      https://github.com/domoticz/libwebem/blob/dfe946fa32f4c211662e47ef55b8cedfc50a6a76/include/libwebem/session.h#L10-L17
    label: >-
      https://github.com/domoticz/libwebem/blob/dfe946fa32f4c211662e47ef55b8cedfc50a6a76/include/libwebem/session.h#L10-L17
tags:
  - cve.org
epss: 0.00279
epssPercentile: 0.20497
ingestedAt: '2026-10-30T21:09:21.622Z'
---

## Overview

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights` check before invoking a Lua parser script, while its sibling command handlers gate access by role. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input through the `GET /json.htm` endpoint with `type=command` and `param=udevices`. The `script` parameter also lacked a `..` path-traversal guard: `CLuaHandler::executeLuaScript` in `main/LuaHandler.cpp` constructed the filename from the parser directory and the supplied script name before passing it to `luaL_loadfile`. Execution is limited to already-installed valid Lua files; this is not arbitrary code execution, and the advisory states that file-write and upload paths require administrator privileges. This issue is addressed in version 2026.3.

## Affected

- `domoticz <= 2026.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.