Hi all,
I can not find the answer so I ask it here. Is Domoticz vulnarable for teh PHP CVE's released today? Of is the default docker container containing vulnarabilities of theis kind?
Thx in advance,
Ap Berger
Domoticz PHP PHP2SHELL vulnarable?
Moderator: leecollings
-
RNEE
- Posts: 79
- Joined: Sunday 05 August 2018 10:13
- Target OS: Raspberry Pi / ODroid
- Domoticz version: 2026.1
- Location: NL/Eindhoven area
- Contact:
Re: Domoticz PHP PHP2SHELL vulnarable?
Domoticz is written in C++, its plugins etc are Python, Lua and dzVentz.
I dont think Domoticz is vulnerable.
This forum however is PHP.
I dont think Domoticz is vulnerable.
This forum however is PHP.
Last edited by RNEE on Thursday 22 October 2026 12:32, edited 1 time in total.
Domoticz (since 2016) on Docker on Raspberry PI 5 with 500 Gb NVMe|Milight|KaKu + RFXCOM|Goodwe|Smartstuff P1 meter|Buienradar|Afval kalender|Tuya-wifi|Zigbee + deCONZ Conbee II|Marstek Homebattery 5,12Kwh via Modbus on Pusr-dr134|MQTTMapper|Quatt v2|
-
lost
- Posts: 717
- Joined: Thursday 10 November 2016 9:30
- Target OS: Raspberry Pi / ODroid
- Domoticz version:
- Contact:
Re: Domoticz PHP PHP2SHELL vulnarable?
There is indeed a documented command line parameter related to php (-php_cgi_path), never used it myself:
https://wiki.domoticz.com/Command_line_parameters
But looks nothing is enabled by default and php is not even in the list of programming languages on the github page of the project.
Domoticz being small configurations friendly (raspberries...), it's dynamic web handling focus on client side rendering (thus JS) rather than server server side (PHP): For this, better to have the added load distributed on clients than all handled by web server.
https://wiki.domoticz.com/Command_line_parameters
But looks nothing is enabled by default and php is not even in the list of programming languages on the github page of the project.
Domoticz being small configurations friendly (raspberries...), it's dynamic web handling focus on client side rendering (thus JS) rather than server server side (PHP): For this, better to have the added load distributed on clients than all handled by web server.