Critical severity · published Aug 13, 2026
CVE-2026-72841
luci-app-openvpn Path Traversal RCE via instance_name2
9.9
CVSS
0.6%
EPSS
No
On KEV
Description
luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SSH keys in system directories accessible on reboot.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LU
luci · openwrt
before 24.10.7; 25.12.0 before 25.12.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-72841
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-72841
vendor-advisory
https://github.com/openwrt/luci/security/advisories/GHSA-jjcx-c284-2qv8
third-party-advisory
https://www.vulncheck.com/advisories/luci-app-openvpn-path-traversal-rce-via-instance-name2
More from luci
9.9
CVE-2026-72842
OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass
9.8
CVE-2019-12272
In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command…
8.8
CVE-2026-55897
luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root
8.8
CVE-2026-72840
OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write
8.8
CVE-2026-69096
OpenWrt luci-app-dockerman Read ACL Remote Code Execution