CVE-2026-69096— OpenWRT luci 命令注入漏洞

OpenWrt luci-app-dockerman Read ACL Remote Code Execution

OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker.* / docker.container.*, which exposes the docker.container.ttyd_start method even though it performs mutating operations. The run_ttyd handler builds a shell command from the request-controlled id, cmd, and uid fields and passes it to system() without quoting or argv-style execution in the rpcd root context. An authenticated attacker holding only the luci-app-dockerman read ACL can inject shell metacharacters (e.g., in id) to execute arbitrary commands as root via an HTTP POST to /ubus. openwrt-24.10 and openwrt-23.05 do not contain this backend and are not affected; no patched version was known as of the advisory.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

OpenWRT luci 命令注入漏洞

OpenWRT luci是OpenWRT社区开源的一款路由器配置界面。 OpenWRT luci 26.162.29621~507ab5e版本存在命令注入漏洞，该漏洞源于请求控制的id、cmd和uid字段构建shell命令并传递给system()函数时未进行引用或argv-style执行，可能导致经过身份验证的攻击者通过HTTP POST向/ubus发送请求，注入shell元字符并以root权限执行任意命令。

N/A

N/A