Path Traversal Vulnerability in luci-app-openvpn by OpenWRT
CVE-2026-72841

9.4CRITICAL

Key Information:

Vendor

Openwrt

Status
Luci
Vendor
CVE Published:
13 August 2026

What is CVE-2026-72841?

The luci-app-openvpn for OpenWRT has a vulnerability that arises from improper validation of the instance_name2 parameter during file uploads. Authenticated users can exploit this flaw to perform path traversal, enabling them to write arbitrary files outside designated directories. This significant security lapse allows attackers to upload malicious payloads, such as SSH keys, to system directories that are accessible upon reboot, potentially resulting in persistent root code execution.

References

https://github.com/openwrt/luci/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/luci-app-openvpn-pat...
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

faller-dql
.