Executive brief
luci-app-lxc is a web interface for managing LXC containers on OpenWrt routers. A low-privileged user who should have no container management access can bypass authorization checks to directly access backend container APIs, modify container configuration, and exploit path traversal to write malicious scripts executed as root on the host system, leading to complete system compromise.
Technical details
The vulnerability is a frontend/backend authorization mismatch in luci-app-lxc where backend container management routes (admin/services/lxc/*) only check authentication but fail to enforce the same ACL restrictions applied to the frontend page (admin/services/lxccm/overview). A low-privileged authenticated user can directly invoke these backend routes to read and modify container configuration. The vulnerability is compounded by insufficient validation of the `lxc_name` parameter in path construction; attackers can use `/.%2E` (URL-decoded to `..`) to perform path traversal and escape the container directory sandbox. By targeting `/tmp/lib/config` combined with `lxc.hook.start-host`, an attacker can execute arbitrary commands as root on the OpenWrt host. No patch is currently available for affected version 25.12.2.
Affected products
- OpenWrt luci-app-lxc 25.12.2
Timeline
- 2026-07-21: disclosed
- 2026-08-13: advisory