High severity8.8NVD Advisory· Published Jul 12, 2026· Updated Jul 13, 2026

CVE-2026-61875

Description

luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd stores and luci-app-upnp renders without output encoding, executing the payload when administrators view the UPnP or Status pages.

Affected products

Openwrt/luci-app-upnpllm-create

Patches

Vulnerability mechanics

References

github.com/openwrt/luci/security/advisories/GHSA-8v49-6387-7f89nvd
www.vulncheck.com/advisories/luci-app-upnp-stored-xss-via-upnp-port-mapping-descriptionnvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000