CVE-2026-62947: OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download
OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch() without FNMPATHNAME, allowing traversal such as an allowed wildcard prefix followed by ../ to read root-readable files including /etc/shadow. This vulnerability is fixed in 25.12.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenWrt (cgi-io / cgi-download handler via rpcd session.c)to a version that resolves this vulnerability.Fixed in 25.12.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62947?
CVE-2026-62947 has a medium severity rating of 4.9.
How can I mitigate the risks of CVE-2026-62947?
To mitigate CVE-2026-62947, upgrade to OpenWrt version 25.12.5 or later.
What type of vulnerability is CVE-2026-62947?
CVE-2026-62947 is classified as a path traversal vulnerability leading to ACL bypass and arbitrary root file read.
Which systems are affected by CVE-2026-62947?
CVE-2026-62947 affects versions of OpenWrt prior to 25.12.5.
What can attackers achieve by exploiting CVE-2026-62947?
Exploiting CVE-2026-62947 allows attackers to bypass access controls and read files with root privileges.