External risk intelligence

luci-app-openvpn Path Traversal and Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-72841

The vulnerability exists in a web-based management interface component (luci-app-openvpn) for OpenWrt routers. While these interfaces are often restricted to local network access, they are occasionally exposed to the internet in home or small office deployments, making remote reachability possible depending on the specific network configuration.

Path Traversal

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the luci-app-openvpn component, which affects OpenWrt router management interfaces. This issue allows authenticated users to potentially gain unauthorized control by uploading malicious files, leading to persistent code execution. While the primary concern is confirming relevance and exposure, the potential for unauthorized access to router control warrants attention.

Allows authenticated users to write arbitrary files.
Potential for persistent unauthorized code execution.
Confirm relevance and exposure to affected systems.

Attack Path

How an attacker could exploit the issue

An attacker with existing authenticated access can exploit this vulnerability by uploading a specially crafted file. The application fails to properly check the name of the uploaded file, allowing the attacker to specify a path that writes the file to an arbitrary location on the system. This could lead to persistent root code execution if the attacker places malicious content like SSH keys in directories that are read during system startup.

Requires authenticated user access.
Upload file with a manipulated instance name.
Gain persistent root code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow authenticated users to upload arbitrary files, potentially leading to persistent root code execution by placing SSH keys in system directories. This could occur when the file upload functionality is accessible and the `instance_name2` parameter is not properly validated.

System files and persistent code execution.
Arbitrary file uploads via vulnerable parameter.
Unauthorized root access and system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The luci-app-openvpn component, commonly found on OpenWrt routers, presents a critical risk due to a path traversal vulnerability in its file upload functionality. This allows authenticated users to upload arbitrary files, potentially leading to persistent root code execution by placing SSH keys in system directories. Ownership of this vulnerability likely falls to the platform or infrastructure team responsible for managing the router firmware, alongside the security team for assessing and coordinating remediation. The immediate practical step is to identify all instances of luci-app-openvpn, confirm their exposure and criticality, and then plan for mitigation.

Platform or Infrastructure team owns remediation.
Verify instance exposure and criticality.
Plan risk-based mitigation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is luci-app-openvpn?

The luci-app-openvpn component is a module within the LuCI web interface, which is the graphical management environment for OpenWrt operating systems. It enables users to configure and manage OpenVPN services on their routers directly through a browser, simplifying the process of setting up encrypted network connections and VPN tunnels.

What does CVE-2026-72841 mean for security?

This vulnerability is classified as CWE-73, or External Control of File Name or Path. Essentially, the software fails to sanitize input provided by a user during file uploads. Because the system does not properly restrict where these files are saved, an attacker can trick the application into writing files to sensitive system areas instead of the intended directory.

How is this vulnerability triggered?

An attacker triggers this by manipulating the instance_name2 parameter during a file upload process. This path traversal technique only works if the attacker already has authenticated access to the management interface. Simply visiting the login page or sending general network traffic without valid credentials does not trigger the bug.

Is my router at risk according to Halo Surface Signal?

Halo Surface Signal notes that while this component is often restricted to local network access, your risk depends on how your router is configured. If your management interface is exposed to the internet—common in some home or small office setups—the vulnerability is remotely reachable. You should confirm if your administrative web portal is accessible beyond your local network.

How should I respond to CVE-2026-72841?

The first step is to inventory your devices to identify which are running the affected luci-app-openvpn component. Once identified, evaluate whether the management interface needs to be reachable from the internet. Coordinate with your infrastructure team to prioritize applying available updates or restricting access to the management portal to trusted, internal networks only.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.