| Title | Oray Pgyer X5 Pro Router 7.6.1 Relative Path Traversal |
|---|
| Description | Oray Pgyer X5 Pro Router firmware 7.6.1 allows an authenticated management user to place a fetched response outside the intended /tmp directory by supplying ../ in the download API's file_name parameter. The user can replace /etc/openwrt_release with Lua code and then call sys_base_info, which loads that file with dofile() in the root Web process, resulting in root code execution. |
|---|
| Source | ⚠️ https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Download-Path-Traversal-Leads-to-Root-Code-Execution-3eb797159f158086bbd8c34d5c7cc2ba |
|---|
| User | FirmAgent (UID 101822) |
|---|
| Submission | 09/30/2026 13:01 (1 month ago) |
|---|
| Moderation | 10/31/2026 20:21 (1 month later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 429584 [Oray Pugongying X5 Pro up to 7.6.1 /etc/openwrt_release config_restore_ex filename path traversal] |
|---|
| Points | 0 |
|---|