Skip to main content

luci-app-lxc CVE-2026-72842

| EUVDEUVD-2026-58499 CRITICAL
External Control of File Name or Path (CWE-73)
2026-08-13 disclosure@vulncheck.com GHSA-q7c4-ghwq-63xh
Path Traversal RCE
9.4
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
9.4 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.9 CRITICAL

Network-reachable via LuCI with a low-privileged account (PR:L) and low complexity; container-to-host root escape crosses a security boundary (S:C) with full C/I/A loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 13, 2026 - 22:33 vuln.today
CVE Published
Aug 13, 2026 - 22:17 cve.org
CRITICAL 9.4

DescriptionCVE.org

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via /.%2E in the lxc_name parameter to escape container directories and control host-side scripts executed through lxc.hook.start-host, achieving root code execution on the OpenWrt host.

AnalysisAI

Privilege escalation to root in luci-app-lxc, the LXC container management app for OpenWrt's LuCI web interface, allows low-privileged authenticated users to reach backend container-management routes they should not be authorized for due to an ACL inconsistency, then abuse a path-traversal flaw in the lxc_name parameter to hijack host-side container hooks. Chaining the authorization gap with the traversal yields arbitrary code execution as root on the OpenWrt host. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate as low-privileged LuCI user
Delivery
Reach unguarded container route via ACL gap
Exploit
Inject `/.%2E` traversal in lxc_name
Execution
Point lxc.hook.start-host to attacker script
Persist
Trigger container start
Impact
Execute code as root on host
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid but low-privileged authenticated LuCI user account (CVSS PR:L) and network reachability to the LuCI web interface, plus the target host must have luci-app-lxc installed and be using LXC containers whose start is driven through the lxc.hook.start-host hook. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine high-priority issue, not an inflated CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a low-privileged LuCI account (or one obtained through weak credentials) sends a crafted request to a luci-app-lxc backend route that the ACL fails to properly restrict, supplying an lxc_name value containing the encoded traversal `/.%2E` to point outside the intended container directory. By steering the lxc.hook.start-host hook to an attacker-controlled script and triggering a container start, they achieve arbitrary command execution as root on the OpenWrt host. …
Remediation Patch available per vendor advisory: upgrade luci-app-lxc to the fixed release identified in the OpenWrt LuCI GitHub security advisory GHSA-jf59-v86x-fwf2 (https://github.com/openwrt/luci/security/advisories/GHSA-jf59-v86x-fwf2); an exact fixed version number is not present in the provided data, so confirm the patched package version against that advisory and the VulnCheck advisory (https://www.vulncheck.com/advisories/openwrt-luci-app-lxc-acl-inconsistency-authentication-bypass) before validating. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: inventory OpenWrt devices running luci-app-lxc and its current version, restrict network access to the LuCI web interface to trusted administrative networks only, and disable the luci-app-lxc component if container management is not operationally required. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-73 – External Control of File Name or Path

View all
CVE-2025-33053 HIGH POC
8.8
CVE-2023-4634 CRITICAL POC
9.8
CVE-2025-24054 MEDIUM POC
6.5
CVE-2025-0111 HIGH
7.1
CVE-2024-8517 CRITICAL POC
9.8
CVE-2024-55372 CRITICAL POC
9.8
CVE-2026-18048 HIGH POC
7.5
CVE-2024-55371 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Share

CVE-2026-72842 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy