CVE-2026-62947
Medium
Description
OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch() without FNM_PATHNAME, allowing traversal such as an allowed wildcard prefix followed by ../ to read root-readable files including /etc/shadow. This vulnerability is fixed in 25.12.5.
SeverityMedium
CVSS4.9
Exploit probability—
ProductOpenwrt
PublishedJul 15, 2026
First seenJul 15, 2026
Weakness typeCWE-22Path traversal
How to fix
Update
- openwrt openwrt25.12.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openwrt openwrt | v < 25.12.5 | 25.12.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.