# CVE-2026-62947: OpenWrt cgi-io path traversal in cgi-download and cgi-exec

Source: https://junglewise.ai/threats/cve-2026-62947-openwrt-cgi-io-path-traversal-in-cgi-download-and-cgi-exec  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-62947 · Severity: medium · CVSS 4.9 · Published 2026-07-15

OpenWrt is an open-source operating system used for routers and embedded devices. A security flaw in its file download and execution handlers allows an authorized user with limited file access to bypass security restrictions and read any file on the system, including sensitive credentials like password hashes. This could allow a restricted administrator to gain full control over the device.

Technologies: [OpenWrt](https://junglewise.ai/threats/technologies/openwrt). Vendors: [OpenWrt](https://junglewise.ai/threats/vendors/openwrt).

## Quick answers

**Is CVE-2026-62947 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62947 being exploited in the wild.

**How severe is CVE-2026-62947?** Medium severity, with a CVSS score of 4.9, published 15 July 2026.

**Which products and versions are affected?** OpenWrt < 25.12.5.

**Is there a fix for CVE-2026-62947?** A patch was published on 2026-06-27: Fixes merged into cgi-io master branch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62947 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-62947?** Check whether you run OpenWrt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the cgi-download and cgi-exec handlers of the cgi-io component in OpenWrt. The root cause is that the application performs Access Control List (ACL) validation against the requested path before canonicalizing it. Because the underlying rpcd session manager uses fnmatch() without the FNM_PATHNAME flag, an attacker can use a wildcard prefix followed by traversal sequences (e.g., /allowed/path/*/../../etc/shadow) to satisfy the ACL check while accessing files outside the intended directory. Since cgi-io runs with root privileges, this allows an authenticated user with at least one wildcard file-read grant to read any file on the filesystem or execute arbitrary binaries. The issue is fixed in OpenWrt 25.12.5 by ensuring paths are canonicalized before ACL checks.

## Affected products

- OpenWrt OpenWrt < 25.12.5

## Timeline

- 2026-06-27: patched: Fixes merged into cgi-io master branch.
- 2026-07-01: advisory: OpenWrt 25.12.5 release announcement.
- 2026-07-15: disclosed: CVE-2026-62947 published.

## References

- [https://github.com/openwrt/cgi-io/commit/72990b7489872112df31c94032637c907760bae4](https://github.com/openwrt/cgi-io/commit/72990b7489872112df31c94032637c907760bae4)
- [https://github.com/openwrt/cgi-io/pull/4](https://github.com/openwrt/cgi-io/pull/4)
- [https://github.com/openwrt/openwrt/releases/tag/v25.12.5](https://github.com/openwrt/openwrt/releases/tag/v25.12.5)
- [https://github.com/openwrt/openwrt/security/advisories/GHSA-jw5r-xhf5-2xcq](https://github.com/openwrt/openwrt/security/advisories/GHSA-jw5r-xhf5-2xcq)

## Related threats

- [OpenWrt odhcpd and LuCI stored XSS via DHCPv6 hostname injection](https://junglewise.ai/threats/cve-2026-62948-openwrt-odhcpd-and-luci-stored-xss-via-dhcpv6-hostname-injection)
- [OpenWrt Emergency Access Daemon integer underflow in handle_send_a](https://junglewise.ai/threats/cve-2026-55490-openwrt-emergency-access-daemon-integer-underflow-in-handle-send)
- [OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the…](https://junglewise.ai/threats/cve-2026-30872-openwrt-project-is-a-linux-operating-system-targeting-embedded)
- [OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the…](https://junglewise.ai/threats/cve-2026-30871-openwrt-project-is-a-linux-operating-system-targeting-embedded)
- [In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local…](https://junglewise.ai/threats/cve-2025-20748-in-wlan-ap-driver-there-is-a-possible-out-of-bounds-write-due-to)