Description

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via `/.%2E` in the `lxc_name` parameter to escape container directories and control host-side scripts executed through `lxc.hook.start-host`, achieving root code execution on the OpenWrt host.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-13T22:17:23.977Z",
  "pubdate": "2026-08-13T22:17:23.977Z",
  "executiveSummary": "An Access Control List (ACL) inconsistency vulnerability has been identified in the luci-app-lxc package, affecting OpenWrt environments utilizing container management interfaces. This security flaw enables low-privileged authenticated users of the LuCI web interface to bypass authorization boundaries and directly access restricted backend container management routes. By exploiting this authorization failure in conjunction with a path traversal vector, an authenticated attacker with minimal privileges can execute arbitrary commands and achieve full root-level code execution on the underlying OpenWrt host system. The vulnerability presents a severe risk to device integrity, as it transforms low-privileged access into complete administrative compromise through container escape mechanisms and host-side script execution hooks.",
  "technicalDetails": "The vulnerability stems from an inconsistency within the Access Control List implementation of luci-app-lxc, which fails to enforce proper authorization checks on backend container management routes. This allows low-privileged authenticated users to interact with endpoints normally reserved for administrative roles. Exploitation of this authorization bypass leverages a path traversal flaw via the input sequence `/.%2E` injected into the lxc_name parameter. This sequence permits traversal outside the intended container storage directories. By manipulating the lxc_name parameter, an attacker can influence paths and interact with host-side resources. The attack flow proceeds as follows: First, the low-privileged authenticated user sends a crafted HTTP request targeting backend container management routes, bypassing the deficient ACL validation. Second, the user supplies the path traversal payload `/.%2E` within the lxc_name parameter to traverse the filesystem hierarchy. Third, the attacker leverages this traversal capability to manipulate configuration or operational parameters associated with container lifecycle execution. Specifically, the manipulation targets host-side scripts executed through the lxc.hook.start-host configuration directive. When the container initialization sequence triggers the host-side start hook, the arbitrary commands or modified script logic injected via the traversal vector are executed by the container runtime daemon. Because the container runtime typically operates with elevated privileges, this sequence successfully yields root code execution on the underlying OpenWrt host. The vulnerable component is the request handling and authorization logic within luci-app-lxc that processes the lxc_name parameter without adequate input sanitization or strict boundary enforcement."
}