A critical (CVSS 9.9) ACL inconsistency in OpenWrt's luci-app-lxc lets any low-privileged authenticated LuCI user chain a path traversal into root code execution on the host.
What Is It
luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to reach backend container management routes without proper authorization checks. From there, an attacker can supply a path traversal sequence, /.%2E, in the lxc_name parameter to escape the container directory and control host-side scripts executed via lxc.hook.start-host, achieving root code execution on the OpenWrt host.
The issue is classified as CWE-73 (External Control of File Name or Path). It was disclosed through VulnCheck.
Why It Matters
The severity metrics in the CVE record are CNA-supplied, not NVD-assigned: the record is still in Received status, meaning NVD has not completed its own analysis or published an independent score. As submitted, the record carries a CVSS 3.1 base score of 9.9 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, and a CVSS 4.0 score of 9.4 (Critical). Those scores may change once NVD enriches the entry. The relevant properties as scored:
- Network attack vector with low attack complexity and no user interaction
- Only low privileges are required; any authenticated LuCI account is enough
- Scope: Changed: the compromise crosses the container boundary onto the host
- High confidentiality, integrity, and availability impact, both to the vulnerable component and to downstream systems (CVSS 4.0 subsequent-system impacts are all High)
In practical terms, a restricted web-UI account becomes root on the router. The authorization gap plus the traversal primitive means no separate privilege-escalation bug is needed.
What's Vulnerable
The affected vendor and product listed in the record are openwrt / luci, specifically the luci-app-lxc application, with a default status of affected. Consistent with the record's un-enriched Received state, the entry contains no CPE version ranges, so no precise affected-version boundaries are available from the supplied data.
Patch Status
The CVE record was published 2026-08-13 with a status of Received and carries no remediation timeline or required-action data. CVE-2026-72842 does not appear in CISA's Known Exploited Vulnerabilities catalog, so active exploitation is not confirmed and no KEV due date applies. The upstream GitHub Security Advisory (GHSA-jf59-v86x-fwf2) is the authoritative source for both fix availability and the vendor's own severity assessment; operators running luci-app-lxc should consult it directly and, in the interim, restrict LuCI account access and exposure of the management interface.
Sources
- NVD, CVE-2026-72842: https://nvd.nist.gov/vuln/detail/CVE-2026-72842
- OpenWrt LuCI GitHub Security Advisory (GHSA-jf59-v86x-fwf2): https://github.com/openwrt/luci/security/advisories/GHSA-jf59-v86x-fwf2
- VulnCheck Advisory; OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass: https://www.vulncheck.com/advisories/openwrt-luci-app-lxc-acl-inconsistency-authentication-bypass
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog