Directory Traversal Vulnerability in OpenWrt CGI-IO Component
CVE-2026-62947

4.9MEDIUM

Key Information:

Vendor

Openwrt

Status
Openwrt
Vendor
CVE Published:
15 July 2026

What is CVE-2026-62947?

A directory traversal vulnerability exists in OpenWrt's cgi-io component prior to version 25.12.5. This flaw permits unauthorized access to root-readable files, including sensitive files like /etc/shadow, by misusing a wildcard prefix followed by a '../' sequence. The vulnerability arises from the inadequately implemented authorization checks within the cgi-download handler, which leads to path traversal issues before the canonicalization of requested paths. Administrators are advised to upgrade to version 25.12.5 to mitigate this security risk.

Affected Version(s)

openwrt < 25.12.5

References

https://github.com/openwrt/openwrt/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/openwrt/cgi-io/pull/4
x_refsource_MISC
https://github.com/openwrt/cgi-io/commit/72990b7489872112...
x_refsource_MISC

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.