CVE-2026-58652 luci-app-travelmate - Arbitrary Command Execution via UCI Script Parameter
Attackers with delegated write permissions can execute arbitrary commands as root by manipulating UCI script parameters in the travelmate package.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58652?
CVE-2026-58652 is a high-severity command injection vulnerability in openwrt luci-app-travelmate, published on 2 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. While the LuCI UI restricts the auto-login script picker to /etc/travelmate/*.login, this is only a frontend restriction. The backend travelmate service (running as root) reads the raw UCI 'script' and 'script_args' values and executes the configured path when the captive-portal auto-login branch (f_check() in travelmate-functions.sh) is reached. An attacker with delegated write permissions can set script to /bin/sh and script_args to attacker-controlled arguments, resulting in arbitrary command execution as root. Confirmed in luci-app-travelmate/travelmate 2.4.5-r3; travelmate 2.4.6-1 is also affected. Fixed in travelmate 2.4.6-2, which enforces the /etc/travelmate/*.login allowlist in the backend.
Weakness: CWE-78
Which versions are affected by CVE-2026-58652?
How do I fix CVE-2026-58652?
No fix has been published for CVE-2026-58652 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-58652 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58652 exists.
Sources
Also known as GHSA-p35r-3323-6g7g, GHSA-x6j4-vgjq-5839.