What is the CVSS score of CVE-2026-62947?

CVE-2026-62947 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-62947?

Yes, a patch is available for CVE-2026-62947. Update the affected software to the latest version immediately.

OpenWrt cgi-io CVE-2026-62947

EUVD-2026-44756 MEDIUM

Path Traversal (CWE-22)

2026-07-15 GitHub_M

Path Traversal Openwrt

4.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

Requires admin-level ubus session (PR:H); network-reachable endpoint (AV:N); impacts only confidentiality via sensitive file disclosure, no integrity or availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 15, 2026 - 21:18 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 18:46 vuln.today

Analysis Generated

Jul 15, 2026 - 18:46 vuln.today

CVE Published

Jul 15, 2026 - 17:55 cve.org

MEDIUM 4.9

DescriptionCVE.org

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch() without FNM_PATHNAME, allowing traversal such as an allowed wildcard prefix followed by ../ to read root-readable files including /etc/shadow. This vulnerability is fixed in 25.12.5.

AnalysisAI

Path traversal in OpenWrt's cgi-io cgi-download handler (prior to 25.12.5) allows an authenticated administrator to read arbitrary root-readable files - including /etc/shadow - by exploiting a TOCTOU-style authorization flaw where ACL checks occur before path canonicalization. The rpcd session.c ACL matcher uses fnmatch() without FNM_PATHNAME, meaning a wildcard-prefixed ACL entry (e.g., /etc/config/*) can be defeated by appending ../ sequences that pass the ACL check but resolve to an out-of-scope file when open() is called. No public exploit identified at time of analysis; vendor-released patch is available in v25.12.5.

Technical ContextAI

The vulnerability (CWE-22, Path Traversal) exists in main.c of the cgi-io package, which provides the CGI download handler for OpenWrt's web interface. The root cause is an ordering flaw: the requested path is checked against the caller's ubus session file ACL before being canonicalized, rather than after. The ubus session ACL in rpcd (session.c) uses the POSIX fnmatch() function without the FNM_PATHNAME flag. Without FNM_PATHNAME, the '*' wildcard matches any character including '/', so a path like /etc/config/../shadow matches the pattern /etc/config/* at the ACL check stage. However, when open() subsequently receives the uncanonicalized path, the kernel resolves the embedded '..' and opens /etc/shadow instead. The PR diff at https://github.com/openwrt/cgi-io/pull/4 confirms the fix introduces canonicalize_path() before the session_access() ACL call, closing the TOCTOU window. The same class of flaw was also present in the main_exec handler for executable path checks. Affected CPE: cpe:2.3:a:openwrt:openwrt:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to OpenWrt 25.12.5, which introduces path canonicalization before ACL validation in both the cgi-download and main_exec handlers. Firmware images are available via the OpenWrt Firmware Selector at https://firmware-selector.openwrt.org/?version=25.12.5 and from download servers at https://downloads.openwrt.org/releases/25.12.5/targets/. The upstream fix is in cgi-io commit 72990b7 (https://github.com/openwrt/cgi-io/commit/72990b7489872112df31c94032637c907760bae4) and PR https://github.com/openwrt/cgi-io/pull/4. If immediate firmware upgrade is not feasible, restrict network access to the LuCI/CGI management interface to trusted hosts only (e.g., via firewall rules limiting access to port 80/443 on the LAN interface), which reduces exposure by ensuring only already-trusted network positions can reach the cgi-download endpoint. Note that this compensating control does not eliminate the vulnerability - it only reduces the network attack surface. Additionally, auditing and narrowing ubus session ACL grants to the minimum required paths limits traversal scope. Note that this release also fixes several critical vulnerabilities in odhcpd (CVE-2026-53921 et al.), making upgrading strongly advisable regardless.