Vulnerability · Published Jul 15, 2026 · Assigned by GitHub_M

CVE-2026-62947OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download

Medium 4.9

In plain English

A medium-severity path traversal in openwrt from openwrt. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)0.5%top 55.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch() without FNM_PATHNAME, allowing traversal such as an allowed wildcard prefix followed by ../ to read root-readable files including /etc/shadow. This vulnerability is fixed in 25.12.5.

Affected products (as reported)

Vendor	Product	Versions
openwrt	openwrt	< 25.12.5

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/openwrt/openwrt/security/advisories/GHSA-jw5r-xhf5-2xcq x_refsource_CONFIRM
https://github.com/openwrt/cgi-io/pull/4 x_refsource_MISC
https://github.com/openwrt/cgi-io/commit/72990b7489872112df31c94032637c907760bae4 x_refsource_MISC
https://github.com/openwrt/openwrt/releases/tag/v25.12.5 x_refsource_MISC