CVE-2026-72842
CriticalCVSS 9.9Summary
luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via `/.%2E` in the `lxc_name` parameter to escape container directories and control host-side scripts executed through `lxc.hook.start-host`, achieving root code execution on the OpenWrt host.
Risk Assessment
The risk includes full host takeover of OpenWrt by an authenticated but low-privileged user, potentially leading to complete device and network compromise.
Recommendation
It is recommended to immediately update luci-app-lxc to a patched version and restrict LuCI panel access to trusted users only.
Original NVD description (English source)
luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via `/.%2E` in the `lxc_name` parameter to escape container directories and control host-side scripts executed through `lxc.hook.start-host`, achieving root code execution on the OpenWrt host.