Path Traversal in luci-app-openvpn via instance_name2 Parameter

The luci-app-openvpn package, part of the OpenWrt LuCI web interface, is susceptible to a path traversal vulnerability identified as CVE-2026-72841. This vulnerability exists due to improper validation of the 'instance_name2' parameter during file upload operations. An authenticated user can supply crafted input to this parameter to navigate outside the intended upload directory, enabling the writing of files to arbitrary locations on the underlying system. This flaw is particularly dangerous as it allows attackers to place malicious payloads, such as SSH authorized keys, into system-level directories that persist across reboots, ultimately leading to full system compromise and root-level code execution. The vulnerability has been assigned a CVSS v3.1 score of 9.9, reflecting its critical impact on system integrity and availability.

Attack Chain

1. Attacker authenticates to the OpenWrt LuCI web interface with valid credentials.
2. Attacker initiates a file upload action within the OpenVPN instance configuration module.
3. Attacker intercepts the HTTP POST request to the web interface.
4. Attacker modifies the 'instance_name2' parameter to include directory traversal sequences (e.g., ../../../).
5. Attacker includes a malicious payload, such as a public SSH key, in the upload body.
6. The web application fails to sanitize the path, writing the payload to a system directory like '/etc/dropbear/authorized_keys'.
7. The system applies the new configuration, effectively granting the attacker SSH access.
8. Attacker logs in via SSH to achieve persistent root access on the network device.

Impact

Successful exploitation results in full device compromise, allowing unauthorized persistent access and potential lateral movement within the network. Because OpenWrt devices often function as edge routers and firewalls, this vulnerability could be used to intercept or manipulate traffic, exfiltrate sensitive data, or bypass existing security perimeters for an entire organization.

Recommendation

Prioritize patching of all OpenWrt instances. If immediate patching is not possible, disable the LuCI web interface for untrusted users or restrict administrative access to a hardened management network. Monitor system logs for unauthorized modifications to sensitive configuration files within '/etc/'.