CVE-2026-62947

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch() without FNM_PATHNAME, allowing traversal such as an allowed wildcard prefix followed by ../ to read root-readable files including /etc/shadow. This vulnerability is fixed in 25.12.5.

• CWE-22

• https://github.com/openwrt/cgi-io/commit/72990b7489872112df31c94032637c907760bae4Patch
• https://github.com/openwrt/cgi-io/pull/4Issue Tracking, Patch
• https://github.com/openwrt/openwrt/releases/tag/v25.12.5Release Notes
• https://github.com/openwrt/openwrt/security/advisories/GHSA-jw5r-xhf5-2xcqVendor Advisory, Exploit
• https://github.com/openwrt/openwrt/security/advisories/GHSA-jw5r-xhf5-2xcqVendor Advisory, Exploit

Published

Jul 15, 2026

Last Modified

Jul 21, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6287The ShopLentor - WooCommerce Builder for Elementor & Gutenbe…5.4
• CVE-2026-6290Velociraptor versions prior to 0.76.3 contain a vulnerabilit…9.1
• CVE-2026-6291Bleichenbacher padding oracle in PKCS#7 KTRI decryption. Whe…6.5
• CVE-2026-6292The MP Customize Login Page plugin for WordPress is vulnerab…4.3
• CVE-2026-6293The Inquiry Form to Posts or Pages plugin for WordPress is v…4.3
• CVE-2026-6294The Google PageRank Display plugin for WordPress is vulnerab…4.3
• CVE-2026-62948OpenWrt is a Linux operating system targeting embedded devic…9.6
• CVE-2026-6296Heap buffer overflow in ANGLE in Google Chrome prior to 147.…9.6
• CVE-2026-62963Centrifugo is an open-source scalable real-time messaging se…8.7
• CVE-2026-6297Use after free in Proxy in Google Chrome prior to 147.0.7727…8.3
• CVE-2026-6298Heap buffer overflow in Skia in Google Chrome prior to 147.0…4.3
• CVE-2026-6299Use after free in Prerender in Google Chrome prior to 147.0.…8.8