CVE-2026-72841CWE-73

CVE-2026-72841

Critical · published August 14, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
48.9
In the wild
Unconfirmed
What it is

luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SSH keys in system directories accessible on reboot.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
9.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00616 · 48.9th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2026-08-14T02:17Z
References (3)
https://github.com/openwrt/luci/security/advisories/GHSA-jjcx-c284-2qv8 · [email protected]https://www.vulncheck.com/advisories/luci-app-openvpn-path-traversal-rce-via-instance-name2 · [email protected]https://github.com/openwrt/luci/security/advisories/GHSA-jjcx-c284-2qv8 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 13 AUG 21:54Z
    luci-app-openvpn Path Traversal RCE via instance_name2
    cvelistv5