CVE-2026-58652luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the trav…
Updated under an hour ago ()
Does this affect you?
It lists no affected products yet. Add what you run and Signals checks it as products are added.
No exploitation reported and no EPSS estimate yet.
luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. While the LuCI UI restricts the auto-login script picker to /etc/travelmate/*.login, this is only a frontend restriction. The backend travelmate service (running as root) reads the raw UCI 'script' and 'script_args' values and executes the configured path when the captive-portal auto-login branch (f_check() in travelmate-functions.sh) is reached. An attacker with delegated write permissions can set script to /bin/sh and script_args to attacker-controlled arguments, resulting in arbitrary command execution as root. Confirmed in luci-app-travelmate/travelmate 2.4.5-r3; the sink is still present in travelmate 2.4.6-1 and no patched version is known.
- CVSS
- 7.5 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-78
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Deferred
- Record last updated
- Aug 28, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
No affected products are listed yet.
References
- https://github.com/openwrt/luci/commit/f85102548ee8325bfd581a0327b210b5f7670829
- https://github.com/openwrt/luci/security/advisories/GHSA-p35r-3323-6g7g
- https://github.com/openwrt/packages/commit/0627b412ee3a760cc4bca9fc8a5b73de8f33ac10
- https://github.com/openwrt/packages/commit/491f1df06645c4e0757fed4a9f0622e9ce0d300c
- https://github.com/openwrt/packages/commit/71d92bcc9edbc8f95858ce82a8ff5d52500005a2
- https://github.com/openwrt/packages/commit/d6e457a1a70a9010195edeafdc0b8eb6e3b0f7f1
- https://www.vulncheck.com/advisories/luci-app-travelmate-arbitrary-command-execution-via-uci-script-parameter
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.