What’s Vulnerable › Vulnerabilities

CVE-2026-61875: luci-app-upnp Stored XSS via UPnP Port Mapping Description

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-12 · updated 2026-10-24
• Weakness: CWE-79

Description

luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd stores and luci-app-upnp renders without output encoding, executing the payload when administrators view the UPnP or Status pages.

Affected products

• openwrt luci: before 24.10.8; from 25.12.0 before 25.12.5 — fixed in 24.10.8, 25.12.5

How to fix

Upgrade to a fixed version: openwrt luci 24.10.8, 25.12.5. Check the vendor advisory for mitigations.

References

• https://github.com/openwrt/luci/security/advisories/GHSA-8v49-6387-7f89
• https://www.vulncheck.com/advisories/luci-app-upnp-stored-xss-via-upnp-port-mapping-description
• https://github.com/openwrt/luci/security/advisories/GHSA-8v49-6387-7f89

Get alerted when CVE-2026-61875 or the next vulnerability affects your stack