High severity · published Aug 3, 2026
CVE-2026-69095
OpenWrt luci-app-bmx7 Path Traversal via bmx7-info
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query string to escape the intended directory and read sensitive files accessible to the CGI process.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LU
luci · openwrt
before 5890760a454dad2cb00389dba2cdc5e779e0ffdd · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-69095
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-69095
github.com
https://github.com/openwrt/luci/security/advisories/GHSA-8qcq-jgrj-gvmj
www.vulncheck.com
https://www.vulncheck.com/advisories/openwrt-luci-app-bmx7-path-traversal-via-bmx7-info
More from luci
9.9
CVE-2026-72842
OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass
9.9
CVE-2026-72841
luci-app-openvpn Path Traversal RCE via instance_name2
9.8
CVE-2019-12272
In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command…
8.8
CVE-2026-55897
luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root
8.8
CVE-2026-72840
OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write