Zwcrazythursday

OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker.* / docker.container.*, which exposes the docker.container.ttyd start method even though it performs mutating operations. The run ttyd handler builds a shell command from the request-controlled id, cmd, and uid fields and passes it to system() without quoting or argv-style execution in the rpcd root context. An authenticated attacker holding only the luci-app-dockerman read ACL can inject shell metacharacters (e.g., in id) to execute arbitrary commands as root via an HTTP POST to /ubus. openwrt-24.10 and openwrt-23.05 do not contain this backend and are not affected; no patched version was known as of the advisory.

**Name of the Vulnerable Software and Affected Versions** luci-app-samba4 (affected versions not specified) **Description** An issue in the luci-app-samba4 package occurs because read Access Control Lists (ACLs) grant file execution permissions on `/usr/sbin/smbd`. This allows authenticated delegated users to execute the Samba daemon using command-line arguments controlled by the caller. By injecting arbitrary Samba global options, such as the message command, an attacker can trigger command execution with root privileges when SMB protocol messages are processed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** luci-app-travelmate versions 2.4.5-r3 through 2.4.6-1 travelmate versions 2.4.5-r3 through 2.4.6-1 **Description** A privilege-escalation flaw exists where a LuCI/rpcd session with write ACL for luci-app-travelmate is granted config-wide UCI write access to the travelmate configuration. Although the user interface restricts the auto-login script selection to /etc/travelmate/*.login, this is only a frontend restriction. The backend travelmate service, which runs as root, reads the raw UCI `script` and `script args` values and executes the path when the captive-portal auto-login branch `f check()` in travelmate-functions.sh is reached. An attacker with delegated write permissions can change `script` to /bin/sh and provide controlled arguments in `script args` to execute arbitrary commands as root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.