CVE-2026-62947

Analyzed Analyzed - Analysis Complete

Path Traversal in OpenWrt cgi-download Handler

Publication date: 2026-07-15

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch() without FNM_PATHNAME, allowing traversal such as an allowed wildcard prefix followed by ../ to read root-readable files including /etc/shadow. This vulnerability is fixed in 25.12.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-21

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-62947

EUVD

EUVD-2026-44756

Affected Vendors & Products

Vendor	Product	Version / Range
openwrt	openwrt	to 25.12.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-62947 is an ACL bypass in OpenWrt's cgi-io component due to improper path handling. The cgi-download handler checks file paths against user permissions before canonicalizing them, allowing path traversal sequences like ../ to bypass restrictions. For example, a request for /etc/apk/keys/../../shadow resolves to /etc/shadow after canonicalization but the ACL check sees the raw path, permitting unauthorized access to sensitive files such as /etc/shadow.

Detection Guidance

Check OpenWrt version with `opkg list-installed | grep openwrt` or `cat /etc/openwrt_version`. If version is below 25.12.5, the system is vulnerable. Inspect cgi-io package version with `opkg list-installed | grep cgi-io`. Monitor logs for unusual file access attempts in /var/log/ubus.log or /var/log/rpcd.log.

Impact Analysis

An attacker with a valid session and specific permissions could exploit this to read root-accessible files, including sensitive data like /etc/shadow, password hashes, Wi-Fi credentials, or VPN keys. This could lead to system compromise, data theft, or further attacks if credentials are exposed.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Exposure of personal or health data may result in compliance breaches, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade OpenWrt to version 25.12.5 or later immediately. Apply the cgi-io patch if available for your version. Restrict access to the cgi-download handler in LuCI or UCI. Review and tighten ACL permissions for all users, especially those with wildcard file-read grants.

Hi! I’m here to help you understand CVE-2026-62947. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70