CVE-2026-61875
HIGHluci-app-upnp Stored XSS via UPnP Port Mapping Description
Title source: cnaDescription
luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd stores and luci-app-upnp renders without output encoding, executing the payload when administrators view the UPnP or Status pages.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-8v49-6387-7f89)
https://github.com/openwrt/luci/security/advisories/GHSA-8v49-6387-7f89
Third Party Advisory third-party-advisory
VulnCheck Advisory: luci-app-upnp Stored XSS via UPnP Port Mapping Description
https://www.vulncheck.com/advisories/luci-app-upnp-stored-xss-via-upnp-port-mapping-description
Scores
CVSS v3
8.8
EPSS
0.0029
EPSS Percentile
20.9%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-79
Status
published
Products (1)
openwrt/luci
Published
Jul 12, 2026
Tracked Since
Jul 12, 2026