CVE-2026-72841

criticalCVSS 9.9covered by 1 sourcefirst seen 2026-08-13

luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SSH keys in system directories accessible on reboot.

⚡ Watch CVE-2026-72841

Get an email if CVE-2026-72841 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.42% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 35% of all EPSS-scored CVEs.

Advisory coverage (1)

criticalCVE-2026-72841: luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, a…nvd · 2026-08-13

External references

NVD record for CVE-2026-72841

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-72841 status](https://www.csirts.com/badge/CVE-2026-72841)](https://www.csirts.com/cve/CVE-2026-72841)