CVE-2026-1001

Overview

Domoticz versions prior to 2026.1 are affected by a stored cross-site scripting (XSS) vulnerability in the Add Hardware and rename device functionality of the web interface. The root cause is improper output encoding of user-supplied names, allowing script or HTML markup to be stored and later rendered in the browser of users viewing the affected page [1][2].

Exploitation

An authenticated administrator can supply crafted names containing malicious script or HTML markup when adding hardware or renaming a device. This stored payload is then executed in the browsers of other users (including administrators) who visit the affected pages. The attack requires authenticated access with administrative privileges, but does not require any special network position or additional authentication [2].

Impact

Successful exploitation enables an attacker to execute arbitrary scripts in the context of the victim's session, leading to unauthorized actions such as modifying system settings, exfiltrating sensitive data, or performing other actions within the victim's session context. The vulnerability is classified as medium severity with a CVSS v3 score of 4.8 [1].

Mitigation

The vulnerability is fixed in Domoticz version 2026.1, which was released on March 25, 2026. Users are advised to update immediately to the latest version to remediate the issue [1]. No workarounds are available for unpatched versions.