| Title | Oray Pgyer X5 Pro Router 7.6.1 Relative Path Traversal |
|---|
| Description | Oray Pgyer X5 Pro Router firmware 7.6.1 allows an administrator with the management system password to put parent directory components in the filename parameter of config_restore_ex. In URL download mode, the API writes the fetched content outside its /tmp staging area before validating the backup. Writing Lua code to /etc/openwrt_release and then calling sys_base_info executes that code in the root Web process, even though the restore request reports an invalid cipher file. |
|---|
| Source | ⚠️ https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Configuration-Restore-Filename-Traversal-Leads-to-Root-Code-Execution-3eb797159f158017a2cbe1732b7ffa6c |
|---|
| User | FirmAgent (UID 101822) |
|---|
| Submission | 09/30/2026 13:01 (1 month ago) |
|---|
| Moderation | 10/31/2026 20:21 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 429584 [Oray Pugongying X5 Pro up to 7.6.1 /etc/openwrt_release config_restore_ex filename path traversal] |
|---|
| Points | 20 |
|---|