CVE-2026-102815 is an operating-system command injection vulnerability in the tmpServer service of TP-Link RE305 V3. The vulnerable service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process on the device can submit crafted requests to the TDDPv1 service to execute arbitrary OS commands with root privileges. This vulnerability allows privilege escalation from low-privileged user to root on the affected device.