Privilege Escalation Vulnerability in Domoticz Home Automation System

CVE-2026-75520

What is CVE-2026-75520?

Domoticz, an open-source home automation platform, is susceptible to privilege escalation due to insufficient validation within the udevices JSON command handler. This vulnerability enables a low-privileged authenticated user to trigger existing operator-installed Lua scripts via the GET /json.htm endpoint using attacker-controlled input. Notably, the vulnerability stems from the absence of session rights checks and the lack of proper path traversal guards, allowing exploitation of the Lua files under certain conditions. It is essential to upgrade to version 2026.3 to mitigate this issue and enhance system security.

References