CVE-2026-62947

Name of the Vulnerable Software and Affected Versions OpenWrt versions prior to 25.12.5

Description The cgi-download handler in cgi-io performs path authorization against the caller's ubus session file ACL before canonicalization. Additionally, rpcd session.c utilizes the fnmatch() function without the FNM PATHNAME flag. This combination allows for path traversal, where an allowed wildcard prefix followed by ../ can be used to read root-readable files, such as /etc/shadow.

Recommendations Update to version 25.12.5.