A path traversal flaw in OpenWrt's LuCI OpenVPN web app lets any authenticated user write arbitrary files to the filesystem and escalate to persistent root code execution, scoring CVSS 9.9 (Critical).
What Is It
luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload. An authenticated user can supply traversal sequences in that parameter to write uploaded files outside the intended directory; anywhere the web process can reach. The issue is tracked as CWE-73 (External Control of File Name or Path) and was disclosed by VulnCheck.
Why It Matters
The described attack path goes beyond arbitrary file write: attackers upload malicious payloads and place SSH keys into system directories that are read on reboot, yielding persistent root code execution on the device.
The severity ratings reflect that. NVD carries a primary CVSS 3.1 score of 9.9 Critical (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and a secondary CVSS 4.0 score of 9.4 Critical. Attack vector is network, complexity is low, no user interaction is required, and only low privileges are needed. The changed scope in the 3.1 vector, and the high subsequent-system impacts in the 4.0 vector, indicate compromise extends past the vulnerable component itself.
The privilege requirement is the only real barrier. On a router's LuCI interface, a low-privileged authenticated account is a much lower bar than a pre-auth exploit, but it is not nothing.
What's Vulnerable
The affected vendor is openwrt and the affected product is luci, specifically the luci-app-openvpn component. The NVD record lists a default status of affected with no enumerated CPEs and no version ranges, so precise affected versions are not established in the supplied data. Consult the upstream GitHub Security Advisory (GHSA-jjcx-c284-2qv8) for version specifics.
Patch Status
No patch information, fixed version, or remediation guidance is present in the supplied NVD record. There is no CISA KEV entry for this CVE in the supplied data, so active exploitation is not confirmed at this time. The record was published 2026-08-13 with a vulnerability status of Received, meaning NVD analysis is still pending. Treat the upstream OpenWrt advisory as the authoritative source for fix availability.
Sources
- OpenWrt LuCI Security Advisory (GHSA-jjcx-c284-2qv8): https://github.com/openwrt/luci/security/advisories/GHSA-jjcx-c284-2qv8
- VulnCheck Advisory: luci-app-openvpn Path Traversal RCE via instance_name2: https://www.vulncheck.com/advisories/luci-app-openvpn-path-traversal-rce-via-instance-name2
- NVD: CVE-2026-72841: https://nvd.nist.gov/vuln/detail/CVE-2026-72841