Skip to main content

luci-app-openvpn EUVDEUVD-2026-58549

| CVE-2026-72841 CRITICAL
External Control of File Name or Path (CWE-73)
2026-08-13 disclosure@vulncheck.com GHSA-x5wv-6f33-ph3p
File Upload Path Traversal RCE
9.4
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
9.4 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.9 CRITICAL

Network-reachable upload needs only a low-privileged authenticated session (PR:L, AC:L); root file write escapes the web app to compromise the whole OS, so S:C with C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 13, 2026 - 22:32 vuln.today
CVE Published
Aug 13, 2026 - 22:17 cve.org
CRITICAL 9.4

DescriptionCVE.org

luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SSH keys in system directories accessible on reboot.

AnalysisAI

Arbitrary file write in OpenWrt's luci-app-openvpn (the LuCI web-interface plugin for managing OpenVPN) lets an authenticated web user smuggle a path-traversal sequence through the instance_name2 upload parameter to write files anywhere on the device filesystem. Because OpenWrt processes run as root, an attacker can drop an SSH key into a system directory and obtain persistent root code execution across reboots. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to LuCI web UI
Delivery
Submit file upload with malicious instance_name2
Exploit
Traverse path outside OpenVPN config dir
Execution
Write SSH key to system directory as root
Persist
Reboot or trigger boot-time read
Impact
Gain persistent root SSH access
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated LuCI session (PR:L) on a device with the luci-app-openvpn plugin installed and its web-based OpenVPN configuration upload feature reachable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with high vulnerable- and subsequent-system impact (VC/VI/VA:H, SC/SI/SA:H) reflects a genuinely severe, low-complexity, network-reachable flaw whose only gate is a single authenticated session - consistent with the description's 'authenticated users' and root outcome. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained (or guessed) valid LuCI credentials for an internet- or LAN-exposed OpenWrt router logs in, opens the OpenVPN configuration upload, and submits a file with an instance_name2 value containing '../' traversal sequences pointing at a system directory. The uploaded content is written as root into, for example, the Dropbear authorized_keys file, and on the next reboot (or immediately) the attacker's SSH key grants persistent root shell access. …
Remediation Upgrade luci-app-openvpn to the fixed release referenced in the OpenWrt GHSA advisory (https://github.com/openwrt/luci/security/advisories/GHSA-jjcx-c284-2qv8) - the exact patched version is not stated in the provided data and must be taken from that advisory (Upstream fix available via the LuCI security advisory; a specific released package version is not independently confirmed here). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all OpenWrt devices running luci-app-openvpn and identify which have publicly exposed web management interfaces; no public exploit has been identified yet, providing a window to remediate before potential weaponization. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-73 – External Control of File Name or Path

View all
CVE-2025-33053 HIGH POC
8.8
CVE-2023-4634 CRITICAL POC
9.8
CVE-2025-24054 MEDIUM POC
6.5
CVE-2025-0111 HIGH
7.1
CVE-2024-8517 CRITICAL POC
9.8
CVE-2024-55372 CRITICAL POC
9.8
CVE-2026-18048 HIGH POC
7.5
CVE-2024-55371 CRITICAL POC
9.8

Same technique File Upload

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2017-12617 HIGH POC
8.1
CVE-2020-1938 CRITICAL POC
9.8
CVE-2024-50623 CRITICAL POC
9.8
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2018-9206 CRITICAL POC
9.8
CVE-2024-5084 CRITICAL POC
9.8

Share

EUVD-2026-58549 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy