CVE-2026-62947

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch() without FNM_PATHNAME, allowing traversal such as an allowed wildcard prefix followed by ../ to read root-readable files including /etc/shadow. This vulnerability is fixed in 25.12.5.

• CWE-22

• https://github.com/openwrt/cgi-io/commit/72990b7489872112df31c94032637c907760bae4Patch
• https://github.com/openwrt/cgi-io/pull/4Issue Tracking, Patch
• https://github.com/openwrt/openwrt/releases/tag/v25.12.5Release Notes
• https://github.com/openwrt/openwrt/security/advisories/GHSA-jw5r-xhf5-2xcqVendor Advisory, Exploit
• https://github.com/openwrt/openwrt/security/advisories/GHSA-jw5r-xhf5-2xcqVendor Advisory, Exploit

Published

Jul 15, 2026

Last Modified

Jul 21, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6294The Google PageRank Display plugin for WordPress is vulnerab…4.3
• CVE-2026-62940Incus is a system container and virtual machine manager. Pri…9.9
• CVE-2026-62941Incus is a system container and virtual machine manager. Pri…9.9
• CVE-2026-62943btrbk is a tool for creating snapshots and remote backups of…8.7
• CVE-2026-62945TREK is a collaborative travel planner. Prior to 3.1.3, TREK…4.3
• CVE-2026-62946ImageMagick is free and open-source software used for editin…4.7
• CVE-2026-62948OpenWrt is a Linux operating system targeting embedded devic…9.6
• CVE-2026-62949AsyncSSH is a Python package which provides an asynchronous …6.5
• CVE-2026-6295The WP Optimizer plugin for WordPress is vulnerable to SQL I…4.9
• CVE-2026-62958libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a …7.9
• CVE-2026-62959Coturn is a free open source implementation of TURN and STUN…8.2
• CVE-2026-6296Heap buffer overflow in ANGLE in Google Chrome prior to 147.…9.6