luci-app-lxc CVE-2026-72842

Exploitation requires a valid but low-privileged authenticated LuCI user account (CVSS PR:L) and network reachability to the LuCI web interface, plus the target host must have luci-app-lxc installed and be using LXC containers whose start is driven through the lxc.hook.start-host hook. The concrete technical prerequisite is the encoded path-traversal payload /.%2E injected into the lxc_name parameter to escape the container directory, combined with the ACL inconsistency that lets a non-privileged role reach backend container-management routes. Limiting factors: the attacker cannot be fully unauthenticated (some LuCI credentials are needed), the LuCI interface and the LXC app must be exposed and in use, and containers must be startable by the attacker to fire the hijacked host hook - so hardened deployments without luci-app-lxc or without reachable LuCI logins are not exposed.

This is a genuine high-priority issue, not an inflated CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network-reachable, low-complexity exploitation needing only a low-privileged authenticated LuCI account and no user interaction, and every impact metric - vulnerable and subsequent system confidentiality, integrity and availability - is High, reflecting a container-to-host escape ending in root. The main limiting factor is the PR:L requirement: the attacker needs some valid LuCI login, so exposure depends on how many low-tier accounts exist and whether the LuCI interface is reachable, which meaningfully reduces mass-scanning risk compared with an unauthenticated flaw. No CISA KEV listing and no EPSS score were provided, and no public proof-of-concept is referenced, so there is no evidence of active or automated exploitation yet; however, the combination of trivial complexity, a clear root-code-execution outcome, and two credible advisories means even a mid-sized municipal IT team in zabrze running OpenWrt with luci-app-lxc should treat patching as urgent rather than waiting for in-the-wild reports. Absence of KEV/EPSS data is a data gap, not evidence of low risk.

An attacker with a low-privileged LuCI account (or one obtained through weak credentials) sends a crafted request to a luci-app-lxc backend route that the ACL fails to properly restrict, supplying an lxc_name value containing the encoded traversal /.%2E to point outside the intended container directory. By steering the lxc.hook.start-host hook to an attacker-controlled script and triggering a container start, they achieve arbitrary command execution as root on the OpenWrt host. No public proof-of-concept is referenced, but the low attack complexity makes reliable exploitation plausible once route details are known.