High severity · published Jul 12, 2026
CVE-2026-61875
luci-app-upnp Stored XSS via UPnP Port Mapping Description
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd stores and luci-app-upnp renders without output encoding, executing the payload when administrators view the UPnP or Status pages.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LU
luci · openwrt
before 24.10.8; 25.12.0 before 25.12.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-61875
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-61875
vendor-advisory
https://github.com/openwrt/luci/security/advisories/GHSA-8v49-6387-7f89
third-party-advisory
https://www.vulncheck.com/advisories/luci-app-upnp-stored-xss-via-upnp-port-mapping-description
More from luci
9.9
CVE-2026-72842
OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass
9.9
CVE-2026-72841
luci-app-openvpn Path Traversal RCE via instance_name2
9.8
CVE-2019-12272
In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command…
8.8
CVE-2026-55897
luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root
8.8
CVE-2026-72840
OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write