CVE-2026-72841 in LuCI
Summary
by MITRE • 08/14/2026
luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SSH keys in system directories accessible on reboot.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability exists within the luci-app-openvpn web interface component of OpenWrt systems where insufficient validation of the instance_name2 parameter during file upload operations creates a critical path traversal flaw. The issue stems from improper input sanitization that allows authenticated users to manipulate file paths and write content outside designated directories, effectively bypassing access controls. This weakness enables attackers to execute arbitrary code with root privileges by placing malicious SSH keys in system directories such as /etc/dropbear or /root/.ssh that persist across reboots.
The technical exploitation involves uploading files with crafted instance_name2 parameters containing directory traversal sequences like ../../ or ..\.. which bypass normal file system restrictions. When the application processes these uploads without proper path validation, it writes files to arbitrary locations on the filesystem where attacker-controlled code can be executed with elevated privileges. This vulnerability directly maps to CWE-22 Path Traversal and CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component, both classified under the OWASP Top Ten A01:2021 - Broken Access Control category.
From an operational perspective, this vulnerability represents a severe risk for network infrastructure devices running OpenWrt with luci-app-openvpn installed. Attackers can leverage this flaw to establish persistent backdoors that survive system reboots, making it particularly dangerous in enterprise and IoT environments where device management is critical. The path traversal capability allows for writing to sensitive system directories including those containing authentication credentials, configuration files, or service binaries, potentially leading to complete system compromise.
Mitigation strategies should include immediate patching of the affected OpenWrt versions, implementing proper input validation and sanitization for all file upload parameters, and restricting write permissions on critical system directories. Network segmentation and monitoring of file upload activities can help detect potential exploitation attempts. The ATT&CK framework categorizes this vulnerability under T1059 Command and Scripting Interpreter and T1543 Create or Modify System Process, as it enables attackers to establish persistent execution mechanisms through system-level file manipulation. Organizations should also implement principle of least privilege for web interface users and regularly audit system configurations to prevent unauthorized modifications that could enable similar exploitation paths.