PT-2026-67336 · Openwrt · Luci

Lujiefsi · CVE-2026-68583 · Published 2026-08-02 · Updated 2026-08-02

NVD

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser under the LuCI origin.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-68583

Affected Products

Luci

References · 3

• https://github.com/openwrt/luci/security/advisories/GHSA-q335-4c83-c88h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-68583 · Security Note
• https://vulncheck.com/advisories/luci-app-adblock-fast-before-4-stored-xss-via-file-url-name · Note