The luci-app-travelmate package in OpenWrt contains a privilege escalation vulnerability due to improper neutralization of special elements in OS command execution. A session with delegated write ACL to luci-app-travelmate can write arbitrary values to the 'script' and 'script_args' UCI configuration keys. Although the frontend UI restricts the script picker to a safe directory, this restriction is not enforced on the backend. The travelmate service, running as root, executes the configured script path when the captive-portal auto-login function is triggered. By setting 'script' to /bin/sh and controlling 'script_args', an attacker can execute arbitrary commands as root. This issue is confirmed in luci-app-travelmate 2.4.5-r3 and remains in 2.4.6-1. No official fix or patch is currently known.

An attacker with delegated write permissions to luci-app-travelmate can escalate privileges to root by injecting arbitrary OS commands. This allows full control over the device running the travelmate service, potentially compromising system integrity and confidentiality. The vulnerability is rated high severity with a CVSS 4.0 score of 7.7, reflecting the network attack vector, required privileges, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict write access to luci-app-travelmate configuration to trusted users only. Avoid delegating write permissions to untrusted sessions. Monitor for unusual configuration changes to the 'script' and 'script_args' UCI keys. Consider disabling or restricting the travelmate auto-login feature if possible.