CVE-2026-61875

luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd stores and luci-app-upnp renders without output encoding, executing the payload when administrators view the UPnP or Status pages.

CVSS 4.0

8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS

0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-25)

CWE

CWE-79

Published

2026-07-12

Modified

2026-10-24

Record from

the NVD, synced 2026-10-25

References

• https://github.com/openwrt/luci/security/advisories/GHSA-8v49-6387-7f89
• https://www.vulncheck.com/advisories/luci-app-upnp-stored-xss-via-upnp-port-mapping-description
• https://github.com/openwrt/luci/security/advisories/GHSA-8v49-6387-7f89

Check your stackJSON