CVE-2026-72842

Name of the Vulnerable Software and Affected Versions luci-app-lxc (affected versions not specified)

Description An ACL inconsistency allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. By using path traversal via /.%2E in the lxc name parameter, an attacker can escape container directories and control host-side scripts executed through lxc.hook.start-host, resulting in root code execution on the OpenWrt host.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.