CVE-2026-62947
OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch() without FNM_PATHNAME, allowing traversal such as an allowed wildcard prefix followed by ../ to read root-readable files including /etc/shadow. This vulnerability is fixed in 25.12.5.
- Affected products
- Openwrt
- Openwrt
- < 25.12.5
- Fix
- Available
- CVSS 3.1
- 4.9 MEDIUM
- EPSS
- 0.4% (33th percentile)
- Weakness
- CWE-22
- NVD status
- Analyzed
- Published
- 2026-07-15
CVE-2026-62947 at NVD
No indexed exploits for CVE-2026-62947 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-62947 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.