OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch() without FNM_PATHNAME, allowing traversal such as an allowed wildcard prefix followed by ../ to read root-readable files including /etc/shadow. This vulnerability is fixed in 25.12.5.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
High
Admin privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Openwrt Openwrt
cpe:2.3:o:openwrt:openwrt:*:*:*:*:*:*:*:*
|
— |
25.12.5
|
References 4
https://github.com/openwrt/cgi-io/commit/72990b7489872112df31c94032637c907760ba…
security-advisories@github.com
https://github.com/openwrt/cgi-io/pull/4
security-advisories@github.com
https://github.com/openwrt/openwrt/releases/tag/v25.12.5
security-advisories@github.com
https://github.com/openwrt/openwrt/security/advisories/GHSA-jw5r-xhf5-2xcq
security-advisories@github.com