CVE-2026-69095CWE-22path-traversal

CVE-2026-69095

High · published August 3, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
60.2
In the wild
Unconfirmed
What it is

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query string to escape the intended directory and read sensitive files accessible to the CGI process.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00928 · 60.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-03T18:16Z
References (3)
https://github.com/openwrt/luci/security/advisories/GHSA-8qcq-jgrj-gvmj · [email protected]https://www.vulncheck.com/advisories/openwrt-luci-app-bmx7-path-traversal-via-bmx7-info · [email protected]https://github.com/openwrt/luci/security/advisories/GHSA-8qcq-jgrj-gvmj · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 AUG 13:20Z
    OpenWrt luci-app-bmx7 Path Traversal via bmx7-info
    cvelistv5