CVE-2026-72841: luci-app-openvpn Path Traversal RCE via instance_name2

Published Aug 13, 2026

Updated

luci-app-openvpn fails to properly validate the instancename2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SSH keys in system directories accessible on reboot.

Affected Software

1 affected component

luci-app-openvpn

Event History

Aug 13, 2026

CVE Published

via MITRE·09:54 PM

Data Sourced

via MITRE·09:54 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-72841?

CVE-2026-72841 is rated as critical with a severity score of 9.9.

How do I fix CVE-2026-72841?

To fix CVE-2026-72841, update to the latest version of luci-app-openvpn that includes patches for the vulnerability.

What type of vulnerability is CVE-2026-72841?

CVE-2026-72841 is a path traversal vulnerability that can lead to remote code execution.

Who is affected by CVE-2026-72841?

Authenticated users of luci-app-openvpn are at risk due to this vulnerability.

What can attackers do with CVE-2026-72841?

Attackers can exploit CVE-2026-72841 to upload malicious payloads and gain persistent root code execution.

CVE-2026-72841: luci-app-openvpn Path Traversal RCE via instance_name2

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-72841?

How do I fix CVE-2026-72841?

What type of vulnerability is CVE-2026-72841?

Who is affected by CVE-2026-72841?

What can attackers do with CVE-2026-72841?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-72841?

How do I fix CVE-2026-72841?

What type of vulnerability is CVE-2026-72841?

Who is affected by CVE-2026-72841?

What can attackers do with CVE-2026-72841?