CVE-2026-58652: luci-app-travelmate Root Command Execution via Privilege Escalation

Technical summary

The flaw is a path-traversal and command-injection vulnerability rooted in a trust boundary bypass. The LuCI web interface enforces a frontend whitelist restricting the script picker to /etc/travelmate/*.login, but this validation is client-side only. The backend travelmate service, invoked at the captive-portal auto-login checkpoint in the f_check() function of travelmate-functions.sh, reads the UCI configuration values 'script' and 'script_args' without validation and directly executes them via shell invocation. A user or process with the luci-app-travelmate write ACL can modify the raw UCI values (bypassing the LuCI UI) to point to any binary and pass arbitrary arguments. Classified as CWE-78 (OS Command Injection), the vulnerability affects travelmate 2.4.5-r3 and persists in version 2.4.6-1; no patched version has been publicly released.

Business impact

This vulnerability enables privilege escalation from a delegated, limited administrative role (LuCI write access to travelmate configuration) to full root command execution. On affected routers or edge devices running travelmate, an attacker with account access or the ability to manipulate local users with such roles can install backdoors, exfiltrate data, modify firewall rules, establish reverse shells, or completely compromise the device and any networks it services. For organizations operating captive-portal gateways or managing fleets of OpenWrt devices with travelmate, this represents a critical control failure—an apparently restricted administrative function becomes a path to OS-level compromise.

Affected systems

luci-app-travelmate and travelmate package versions through 2.4.6-1 are confirmed vulnerable. The vulnerability requires the attacker to hold delegated LuCI/rpcd session permissions with the luci-app-travelmate write ACL. Affected devices are typically OpenWrt-based routers or embedded systems using travelmate for captive-portal auto-login functionality. No patched version is currently known; verify with the OpenWrt/travelmate maintainers for the latest security status.

Exploitability

Exploitability is moderate-to-high given the specific prerequisites. An attacker must already possess or be granted write permissions to the travelmate LuCI configuration—this is not an unauthenticated remote attack. However, once in possession of such permissions (via credential compromise, social engineering, or intentional delegation), exploitation is trivial: directly modifying the UCI 'script' and 'script_args' values to invoke arbitrary commands requires no special tools or conditions. The CVSS score of 7.5 (HIGH) reflects the high-impact consequence (root code execution) balanced against the requirement for prior authentication and privileged role assignment. The vulnerability is not yet tracked in the CISA KEV catalog, suggesting either recent discovery or limited public awareness.

Remediation

No official patch is available as of the last update. Immediate mitigations include: (1) Restrict LuCI access and role-based access controls—audit which accounts or roles hold luci-app-travelmate write permissions and disable unnecessary delegations; (2) Implement network-level access controls to limit administrative access to affected devices; (3) Monitor UCI configuration changes, particularly to the travelmate 'script' and 'script_args' parameters, for anomalies; (4) If travelmate auto-login is not essential, disable the captive-portal auto-login functionality. Contact the OpenWrt/travelmate project directly for patch availability and timeline. Organizations should also prepare to patch as soon as a fix is released.

Patch guidance

No patched version is known at this time. Verify the latest status with the OpenWrt project and travelmate maintainers. When a patch is released, follow the vendor's update instructions for your OpenWrt variant. In the interim, apply administrative and network-level controls (see remediation_summary) to restrict exposure. Test patches in a non-production environment before rolling out to production edge devices.

Detection guidance

Monitor for suspicious modifications to UCI travelmate configuration, specifically unexpected changes to the 'script' or 'script_args' parameters outside of normal administrative workflows. Log and alert on LuCI sessions that modify travelmate settings, especially those setting script to paths outside /etc/travelmate/. Inspect running travelmate processes and their arguments via ps or systemctl status to detect if unusual binaries are being invoked. Network telemetry indicating unexpected outbound connections or commands from affected routers may signal post-exploitation activity. Baseline LuCI user roles and RBAC policies to identify unauthorized privilege grants.

Why prioritize this

This vulnerability merits HIGH priority for organizations running OpenWrt with travelmate in production. While exploitation requires prior authentication with specific permissions, the jump from delegated write access to root command execution is direct and severe. The absence of a known patch means defenders must rely on administrative controls and monitoring. Given the typical deployment of OpenWrt devices at network edges (gateways, captive portals), a compromise could provide a foothold for lateral movement or persistent access to internal networks.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects: Attack Vector = Network (remotely exploitable once credentials are obtained), Attack Complexity = High (requires prior possession of write permissions and specific role), Privileges Required = Low (delegated role, not full admin), User Interaction = None, Scope = Unchanged, and Confidentiality/Integrity/Availability Impact = High (root code execution). The 'High' complexity and privilege requirement prevent a 9.0+ score, but the certainty of root-level impact justifies the 7.5 rating. Organizations should treat this as a critical control gap if they operate affected devices with high-trust RBAC roles.

Frequently asked questions