CVE-2026-72841
luci-app-openvpn Path Traversal RCE via instance_name2
- State
- Published
- Severity
- 9.4 Critical
- Published
- Aug 13, 2026
- Updated
- Sep 30, 2026
- Reserved
- Aug 10, 2026
Description
luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SSH keys in system directories accessible on reboot.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.4 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | VulnCheck |
| 3.1 | 9.9 Critical | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-73 External Control of File Name or Path
Affected Products
| Product | Versions |
|---|---|
luciopenwrt |
|
References
- GitHub Security Advisory (GHSA-jjcx-c284-2qv8)vendor-advisory
- VulnCheck Advisory: luci-app-openvpn Path Traversal RCE via instance_name2third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.