luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted c…

CVE-2026-58652 describes a privilege escalation vulnerability in luci-app-travelmate and the travelmate package for OpenWrt. A session with luci-app-travelmate write ACL gains config-wide UCI write access to travelmate configuration. The LuCI frontend restricts the auto-login script picker to /etc/travelmate/*.login, but this restriction is only enforced client-side. The backend travelmate service runs as root and directly executes UCI 'script' and 'script_args' values without validation when the captive-portal auto-login branch is triggered. An attacker with delegated write permissions can set the script parameter to /bin/sh and supply arbitrary arguments, achieving root-level command execution. The vulnerability is confirmed in versions 2.4.5-r3 and 2.4.6-1, with no patched version available at time of disclosure.