Philips Hue Bridge Pro argument injection allows restricted file writes
Original title: ZDI-26-890: Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability
ZDI rates CVE-2026-118631 at CVSS 3.8 and requires low-privileged code inside a container first.
ZDI published ZDI-26-890, an argument-injection flaw in Philips Hue Bridge Pro tracked as CVE-2026-118631. A local attacker who can already run low-privileged code inside a container can modify files on affected installations. ZDI assigned a CVSS rating of 3.8. The advisory does not name versions, a fix, or known exploitation.
- The issue is CVE-2026-118631, published as ZDI-26-890.
- The attacker must already execute low-privileged code in a container.
- The impact described is a restricted file write.
- ZDI assigned a CVSS rating of 3.8.
Impact: Local restricted file modification after container code execution
| Product | Affected |
|---|---|
| Philips Hue Bridge Pro | — |
- CVEs
- CVE-2026-118631
- Vendors
- Philips
- Products
- Hue Bridge Pro
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-118631 | — | — | — |
From the original article
This vulnerability allows local attackers to modify files on affected installations of Philips Hue Bridge Pro. An attacker must first obtain the ability to execute low-privileged code within a container on the target system, in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 3.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.