| Title | Oray Pgyer X5 Pro Router 7.6.1 Relative Path Traversal |
|---|
| Description | Oray Pgyer X5 Pro Router firmware 7.6.1 does not confine the authenticated package_upgrade API's file_name to its download directory. A filename containing parent directory components makes the API remove and then replace /etc/openwrt_release with attacker supplied content before it checks the package MD5. A mismatched digest prevents installation but leaves the replacement in place, and a later sys_base_info request evaluates it as Lua in the root Web process. |
|---|
| Source | ⚠️ https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Package-Upgrade-Filename-Traversal-Leads-to-Root-Code-Execution-3eb797159f1580ca8a40cebdf61bf2fa |
|---|
| User | FirmAgent (UID 101822) |
|---|
| Submission | 09/30/2026 13:03 (1 month ago) |
|---|
| Moderation | 10/31/2026 20:21 (1 month later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 429584 [Oray Pugongying X5 Pro up to 7.6.1 /etc/openwrt_release config_restore_ex filename path traversal] |
|---|
| Points | 0 |
|---|