OpenWrt luci‑app‑dockerman contains an OS command injection flaw. The read ACL grants broad ubus access to docker.* endpoints, including the mutating docker.container.ttyd_start method. The request handler concatenates user‑controlled parameters into a shell command and passes it to system() from the rpcd root context. As a result, an attacker can inject shell metacharacters – for example by supplying a malicious id – to run arbitrary commands as root when the attacker only possesses the luci‑app‑dockerman read ACL and authenticates via an HTTP POST to /ubus.

The flaw is present in the LuCI master branch and in the openwrt‑25.12 snapshot series that include the ucode docker_rpc.uc RPC backend after the JS/ucode conversion. Versions openwrt‑24.10 and openwrt‑23.05 are not affected because they do not contain the backend. The specific affected package is openwrt:luci – luci‑app‑dockerman. No patched release was publicly available at the time of the advisory.

The CVSS score of 8.7 indicates high severity, and the EPSS score of 2% suggests a low but nonzero exploitation probability. The vulnerability is not yet listed in CISA KEV. Exploitation requires an authenticated attacker who can read the docker RPC read ACL; no additional privileges are needed. Because the command is executed as root via an HTTP POST to /ubus, a successful exploit would grant the attacker full system compromise, enabling data theft, tampering, or service disruption across the affected router.