Description
luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. While the LuCI UI restricts the auto-login script picker to /etc/travelmate/*.login, this is only a frontend restriction. The backend travelmate service (running as root) reads the raw UCI 'script' and 'script_args' values and executes the configured path when the captive-portal auto-login branch (f_check() in travelmate-functions.sh) is reached. An attacker with delegated write permissions can set script to /bin/sh and script_args to attacker-controlled arguments, resulting in arbitrary command execution as root. Confirmed in luci-app-travelmate/travelmate 2.4.5-r3; travelmate 2.4.6-1 is also affected. Fixed in travelmate 2.4.6-2, which enforces the /etc/travelmate/*.login allowlist in the backend.
Published: 2026-07-02
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary command execution as root via privileged LuCI configuration changes
Action: Immediate Mitigation
AI Analysis

Impact

The flaw in luci-app-travelmate is a privilege‑escalation vulnerability (CWE‑78). An attacker who can write to the LuCI or rpcd configuration can set the 'script' and 'script_args' options to arbitrary values. When the travelmate service – which runs as root – later parses these values during the captive‑portal auto‑login check, it executes the configured script. This allows the attacker to run any commands as root, leading to full system compromise.

Affected Systems

OpenWrt luci-app-travelmate and the travelmate package are affected. Versions 2.4.5‑r3 and the subsequent 2.4.6‑1 release contain the flaw, but the issue has been fixed in travelmate 2.4.6‑2. All systems deploying the vulnerable versions remain at risk until updated.

Risk and Exploitability

The flaw carries a CVSS score of 7.7, indicating high severity. Its EPSS score is less than 1%, suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is via an entity that has delegated write permissions through LuCI or rpcd. Because the flaw allows privilege escalation when write access is available, the risk is high for systems that expose the LuCI interface to untrusted parties.

Generated by OpenCVE AI on October 29, 2026 at 23:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict the LuCI write ACL for travelmate so that only trusted administrators can modify its configuration.
  • Disable the auto‑login script feature by clearing or hard‑coding the 'script' and 'script_args' values in the travelmate configuration.
  • Upgrade to travelmate 2.4.6‑2, which contains the fix.
  • Monitor the configuration files for unexpected changes and consider blocking external access to LuCI or rpcd from untrusted networks.

Generated by OpenCVE AI on October 29, 2026 at 23:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
References

Thu, 29 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Description luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. While the LuCI UI restricts the auto-login script picker to /etc/travelmate/*.login, this is only a frontend restriction. The backend travelmate service (running as root) reads the raw UCI 'script' and 'script_args' values and executes the configured path when the captive-portal auto-login branch (f_check() in travelmate-functions.sh) is reached. An attacker with delegated write permissions can set script to /bin/sh and script_args to attacker-controlled arguments, resulting in arbitrary command execution as root. Confirmed in luci-app-travelmate/travelmate 2.4.5-r3; the sink is still present in travelmate 2.4.6-1 and no patched version is known. luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. While the LuCI UI restricts the auto-login script picker to /etc/travelmate/*.login, this is only a frontend restriction. The backend travelmate service (running as root) reads the raw UCI 'script' and 'script_args' values and executes the configured path when the captive-portal auto-login branch (f_check() in travelmate-functions.sh) is reached. An attacker with delegated write permissions can set script to /bin/sh and script_args to attacker-controlled arguments, resulting in arbitrary command execution as root. Confirmed in luci-app-travelmate/travelmate 2.4.5-r3; travelmate 2.4.6-1 is also affected. Fixed in travelmate 2.4.6-2, which enforces the /etc/travelmate/*.login allowlist in the backend.

Fri, 28 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
References

Fri, 28 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
References

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Openwrt
Openwrt luci-app-travelmate
Openwrt travelmate
Vendors & Products Openwrt
Openwrt luci-app-travelmate
Openwrt travelmate

Thu, 02 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 02 Jul 2026 13:00:00 +0000

Type Values Removed Values Added
Description luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. While the LuCI UI restricts the auto-login script picker to /etc/travelmate/*.login, this is only a frontend restriction. The backend travelmate service (running as root) reads the raw UCI 'script' and 'script_args' values and executes the configured path when the captive-portal auto-login branch (f_check() in travelmate-functions.sh) is reached. An attacker with delegated write permissions can set script to /bin/sh and script_args to attacker-controlled arguments, resulting in arbitrary command execution as root. Confirmed in luci-app-travelmate/travelmate 2.4.5-r3; the sink is still present in travelmate 2.4.6-1 and no patched version is known.
Title luci-app-travelmate - Arbitrary Command Execution via UCI Script Parameter
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 7.7, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Openwrt Luci-app-travelmate Travelmate
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-29T21:16:01.526Z

Reserved: 2026-07-01T21:54:37.945Z

Link: CVE-2026-58652

cve-icon Vulnrichment

Updated: 2026-07-02T13:16:11.975Z

cve-icon NVD

Status : Deferred

Published: 2026-07-02T13:17:00.300

Modified: 2026-10-29T21:17:26.360

Link: CVE-2026-58652

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T23:45:03Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')