Description

luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SSH keys in system directories accessible on reboot.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-13T22:17:23.813Z",
  "pubdate": "2026-08-13T22:17:23.813Z",
  "executiveSummary": "An authenticated arbitrary file write vulnerability exists within the luci-app-openvpn component, specifically stemming from improper validation of the instance_name2 parameter during file upload operations. This security flaw enables authenticated threat actors to execute directory traversal attacks, effectively circumventing intended storage boundaries and writing arbitrary files to arbitrary system directories outside the designated upload path. Successful exploitation of this vulnerability yields severe risk implications, allowing attackers to achieve persistent root code execution on affected OpenWrt systems. By leveraging the file write capability, an attacker can place malicious payloads, such as unauthorized SSH authorized_keys, into critical system directories that persist across reboots, thereby establishing long-term unauthorized access. The exploitation requirements dictate that the attacker must possess valid authentication credentials to interact with the vulnerable LuCI interface parameter, after which the flaw can be systematically abused to compromise the underlying operating system integrity.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input validation and sanitization of the instance_name2 parameter processed during file upload routines within the luci-app-openvpn package. When handling file upload requests, the vulnerable component fails to adequately check or strip directory traversal sequences, such as dot-dot-slash patterns, allowing malicious input to manipulate the target file path destination. Consequently, the application interprets the crafted instance_name2 parameter as a valid file system path, directing the file write operation outside the intended application directory and into sensitive system locations. The exploitation method relies on supplying a specially crafted POST request containing directory traversal sequences within the instance_name2 parameter alongside a malicious payload file. The attack flow initiates when an authenticated user or an attacker with compromised credentials submits the manipulated upload request to the LuCI web interface. The vulnerable component processes the request without enforcing proper path normalization or boundary checks, leading to the direct writing of the uploaded payload to the specified absolute or relative path on the underlying file system. The vulnerable component is the file handling mechanism associated with instance_name2 in luci-app-openvpn. The affected versions comprise deployments utilizing the vulnerable luci-app-openvpn implementation lacking proper input validation patches. The authentication requirements dictate that the attacker must have authenticated access to the management interface, while privilege requirements involve interacting with the interface to trigger the file write mechanism, which executes with the privileges of the web daemon or underlying system context depending on the implementation. The network exposure is defined by the accessibility of the LuCI administrative web interface. The payload behavior involves depositing malicious files, such as authorized_keys, into system directories. The post-exploitation impact is profound, resulting in persistent root code execution and complete system compromise upon system reboot or immediate session interaction."
}