PT-2026-60261 · Openwrt · Openwrt

Published 2026-07-15 · Updated 2026-07-15 · CVE-2026-62947

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenWrt versions prior to 25.12.5

Description The cgi-download handler in cgi-io performs path authorization against the caller's ubus session file ACL before canonicalization. Additionally, rpcd session.c utilizes the fnmatch() function without the FNM PATHNAME flag. This combination allows for path traversal, where an allowed wildcard prefix followed by ../ can be used to read root-readable files, such as /etc/shadow.

Recommendations Update to version 25.12.5.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-62947

Affected Products

Openwrt

References · 7

• 🔥 https://github.com/openwrt/openwrt/security/advisories/GHSA-jw5r-xhf5-2xcq · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-62947 · Security Note
• https://github.com/openwrt/openwrt/releases/tag/v25.12.5 · Note
• https://github.com/openwrt/cgi-io/pull/4 · Note
• https://github.com/openwrt/cgi-io/commit/72990b7489872112df31c94032637c907760bae4 · Note
• https://twitter.com/infoflowcloud/status/2077470926006886732 · Twitter Post
• https://twitter.com/CVEnew/status/2077469481467875460 · Twitter Post