luci-app-openvpn Path Traversal Leading to Root Code Execution
First seen Aug 15, 2026 · Updated Aug 15, 2026 · CVSS 9.9
A critical path traversal vulnerability in luci-app-openvpn allows authenticated attackers to write arbitrary files outside the intended upload directory, enabling persistent root-level code execution on OpenWrt-based devices. Exploitation involves planting SSH keys in system directories to maintain access across reboots, making this a severe threat to routers and embedded network infrastructure.
Technical Analysis
CVE-2026-72841 stems from improper input validation of the instance_name2 parameter in luci-app-openvpn's file upload handler, permitting directory traversal sequences (e.g., '../../') to escape the sandboxed upload path. An authenticated but low-privileged user can leverage this to overwrite critical system files or inject SSH authorized_keys entries into root-accessible directories, achieving persistent root access that survives device reboots. The CVSS score of 9.9 reflects the low attack complexity, network attack vector, and full compromise of confidentiality, integrity, and availability. This is a classic embedded-device LuCI web interface flaw, similar in class to prior OpenWrt package vulnerabilities involving insufficient sanitization of user-supplied filenames. For organizations running AI agents at the network edge—such as agentic systems performing autonomous network configuration, IoT orchestration, or router-level automation via SSH/API access—a compromised OpenWrt gateway could serve as a pivot point to intercept or manipulate agent traffic, exfiltrate API keys transiting the network, or inject malicious commands into agent-to-device communication channels.
Affected Systems
OpenWrt devices running luci-app-openvpn package with the vulnerable instance_name2 file upload handler (all versions prior to patched release); routers, gateways, and embedded Linux devices using LuCI web interface with OpenVPN configuration module enabled.
Indicators of Compromise
- Suspicious file writes to /etc/dropbear/authorized_keys or /root/.ssh/authorized_keys via LuCI upload endpoint
- Unexpected instance_name2 parameter values containing '../' sequences in HTTP request logs
- New or modified SSH keys appearing in system directories post-reboot
- Unauthorized LuCI web session activity targeting /cgi-bin/luci/admin/services/openvpn upload paths
Remediation Steps
- 1
Apply vendor patch
Update luci-app-openvpn to the fixed version once released by OpenWrt maintainers; monitor OpenWrt security advisories for patch availability.
- 2
Restrict LuCI web access
Limit LuCI administrative interface access to trusted management networks only, using firewall rules or VPN-only access.
- 3
Audit SSH authorized_keys
Review /etc/dropbear/authorized_keys and /root/.ssh/authorized_keys on all affected devices for unauthorized entries and remove any suspicious keys.
- 4
Enforce strong authentication
Disable default or weak credentials on LuCI accounts and enforce multi-factor or certificate-based authentication where supported.
- 5
Monitor and log uploads
Enable logging on file upload endpoints and alert on path traversal patterns or anomalous instance_name2 values.
- 6
Network segmentation
Isolate OpenWrt devices, especially those used in agent-driven automation or IoT orchestration, from critical infrastructure and API key stores.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.