Executive brief
OpenRGB is lighting control software for RGB peripherals that communicates via a network protocol. A flaw in how it processes profile-save commands allows attackers to overwrite or delete arbitrary files on the system, potentially compromising the entire device or enabling malware installation.
Technical details
The SAVE_PROFILE message in OpenRGB's network protocol fails to properly validate the profile name parameter before using it in file system operations. An attacker can inject path traversal sequences (e.g., "../") or special characters into the profile name to cause the application to write files to unintended locations on disk. The vulnerability affects the ProfileManager::SaveProfile() and ProfileManager::DeleteProfile() functions. No authentication is required as the network interface listens on all interfaces (0.0.0.0) by default. The patch (commit d2dd9dcc) introduces a StringUtils::make_filename() function to sanitize profile names by removing path traversal characters and special characters before file operations.
Affected products
- OpenRGB OpenRGB through 1.0rc3
Timeline
- 2026-08-26: disclosed
- 2026-08-12: patched: Security fixes applied in commit d2dd9dcc