Description
luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. While the LuCI UI restricts the auto-login script picker to /etc/travelmate/*.login, this is only a frontend restriction. The backend travelmate service (running as root) reads the raw UCI 'script' and 'script_args' values and executes the configured path when the captive-portal auto-login branch (f_check() in travelmate-functions.sh) is reached. An attacker with delegated write permissions can set script to /bin/sh and script_args to attacker-controlled arguments, resulting in arbitrary command execution as root. Confirmed in luci-app-travelmate/travelmate 2.4.5-r3; the sink is still present in travelmate 2.4.6-1 and no patched version is known.
Published: 2026-07-02
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in luci-app-travelmate is a command injection flaw (CWE‑78). An attacker who can write to the LuCI or rpcd configuration can set the 'script' and 'script_args' options. The travelmate service, which runs as root, reads these values and executes them when the captive‑portal auto the attacker can run arbitrary commands as root, achieving full system compromise.

Affected Systems

OpenWrt luci-app-travelmate and the travelmate package are affected. Versions 2.4.5‑r3 and the subsequent 2.4.6‑1 release contain the flaw, and no patched version is currently available. All systems deploying these packages remain vulnerable.

Risk and Exploitability

The flaw carries a CVSS score of 7.7, indicating high severity. Its EPSS score is less than 1%, suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is via an entity that has delegated write permissions through LuCI or rpcd. Because the flaw allows privilege escalation when write access is available, the risk is high for systems that expose the LuCI interface to untrusted parties.

Generated by OpenCVE AI on July 21, 2026 at 11:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Restrict the LuCI write ACL for travelmate so that only trusted administrators can modify its configuration.
  • Disable the auto‑login script feature by clearing or hard‑coding the 'script' and 'script_args' values in the travelmate configuration.
  • Upgrade to a patched version of luci-app-travelmate or travelmate once a fix is released.
  • Monitor the configuration files for unexpected changes and consider blocking external access to LuCI or rpcd from untrusted networks.

Generated by OpenCVE AI on July 21, 2026 at 11:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Openwrt
Openwrt luci-app-travelmate
Openwrt travelmate
Vendors & Products Openwrt
Openwrt luci-app-travelmate
Openwrt travelmate

Thu, 02 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 02 Jul 2026 13:00:00 +0000

Type Values Removed Values Added
Description luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. While the LuCI UI restricts the auto-login script picker to /etc/travelmate/*.login, this is only a frontend restriction. The backend travelmate service (running as root) reads the raw UCI 'script' and 'script_args' values and executes the configured path when the captive-portal auto-login branch (f_check() in travelmate-functions.sh) is reached. An attacker with delegated write permissions can set script to /bin/sh and script_args to attacker-controlled arguments, resulting in arbitrary command execution as root. Confirmed in luci-app-travelmate/travelmate 2.4.5-r3; the sink is still present in travelmate 2.4.6-1 and no patched version is known.
Title luci-app-travelmate - Arbitrary Command Execution via UCI Script Parameter
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 7.7, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Openwrt Luci-app-travelmate Travelmate
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-02T13:16:44.529Z

Reserved: 2026-07-01T21:54:37.945Z

Link: CVE-2026-58652

cve-icon Vulnrichment

Updated: 2026-07-02T13:16:11.975Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T11:30:06Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')