openwrt luci-app-travelmate/travelmate 2.4.5-r3 Backend Travelmate Service /etc/travelmate f_check script_args os command injection

Summaryinfo

A vulnerability has been found in openwrt luci-app-travelmate and travelmate 2.4.5-r3 and classified as critical. The affected element is the function f_check of the file /etc/travelmate of the component Backend Travelmate Service. This manipulation of the argument script_args causes os command injection. This vulnerability is handled as CVE-2026-58652. The attack can be initiated remotely. There is not any exploit available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability classified as critical was found in openwrt luci-app-travelmate and travelmate 2.4.5-r3. Affected by this vulnerability is the function f_check of the file /etc/travelmate of the component Backend Travelmate Service. The manipulation of the argument script_args with an unknown input leads to a os command injection vulnerability. The CWE definition for the vulnerability is CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. While the LuCI UI restricts the auto-login script picker to /etc/travelmate/*.login, this is only a frontend restriction. The backend travelmate service (running as root) reads the raw UCI 'script' and 'script_args' values and executes the configured path when the captive-portal auto-login branch (f_check() in travelmate-functions.sh) is reached. An attacker with delegated write permissions can set script to /bin/sh and script_args to attacker-controlled arguments, resulting in arbitrary command execution as root. Confirmed in luci-app-travelmate/travelmate 2.4.5-r3; the sink is still present in travelmate 2.4.6-1 and no patched version is known.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-58652 since 07/01/2026. The exploitation appears to be difficult. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

Applying the patch 0627b412ee3a760cc4bca9fc8a5b73de8f33ac10 is able to eliminate this problem. The bugfix is ready for download at github.com.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• openwrt

Name

• luci-app-travelmate
• travelmate

Version

• 2.4.5-r3

License

• open-source

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion