CVE-2026-69095 Overview
CVE-2026-69095 is a path traversal vulnerability [CWE-22] in OpenWrt luci-app-bmx7, specifically within the bmx7-info Common Gateway Interface (CGI) script. The flaw exists in versions prior to commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd. Unauthenticated remote attackers can inject directory traversal sequences into the query string to escape the configured runtimeDir and read arbitrary files accessible to the CGI process. The vulnerability affects OpenWrt devices running the LuCI web interface with the bmx7 mesh routing application enabled.
Critical Impact
Unauthenticated attackers can read sensitive files on affected OpenWrt routers over the network, exposing configuration data, credentials, and system files readable by the CGI process.
Affected Products
- OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd
- OpenWrt LuCI web interface deployments that include the bmx7 mesh routing package
- OpenWrt-based devices exposing the bmx7-info CGI endpoint
Discovery Timeline
- 2026-08-03 - CVE-2026-69095 published to the National Vulnerability Database (NVD)
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-69095
Vulnerability Analysis
The bmx7-info CGI script exposes runtime data produced by the bmx7 mesh routing daemon through the LuCI web interface. The script accepts a filename parameter through the HTTP query string and concatenates it with the configured runtimeDir path before reading the file from disk. The script does not normalize or validate the supplied path component. Attackers can therefore submit relative traversal sequences such as ../ to escape the intended directory boundary. The CGI process returns the contents of the resolved file in the HTTP response, disclosing any file readable by the process owner.
Root Cause
The root cause is insufficient input validation of user-controlled path segments before file system access, classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. The script trusts the query string parameter and performs no canonicalization, allow-list checks, or containment verification against runtimeDir. This design permits arbitrary file read within the CGI process privilege boundary.
Attack Vector
Exploitation requires only network access to the LuCI web server. No authentication or user interaction is needed. An attacker issues an HTTP GET request to the bmx7-info CGI endpoint with a query parameter containing directory traversal sequences. The CGI process resolves the path and returns the target file content in the HTTP response body. Targets of interest include OpenWrt configuration files under /etc/config/, network state under /tmp/, and credential material accessible to the web server user.
See the GitHub Security Advisory GHSA-8qcq-jgrj-gvmj and the VulnCheck Advisory for OpenWRT for additional technical detail.
Detection Methods for CVE-2026-69095
Indicators of Compromise
- HTTP requests to the bmx7-info CGI endpoint containing ../, ..%2f, or URL-encoded traversal sequences in the query string
- Access log entries showing successful HTTP 200 responses from bmx7-info referencing filenames outside the configured runtimeDir
- Unexpected outbound transfers of OpenWrt configuration or state files from router management interfaces
Detection Strategies
- Deploy web server or reverse proxy rules that log and alert on traversal patterns targeting LuCI CGI paths
- Correlate LuCI access logs with file read patterns that reference paths above the runtimeDir boundary
- Monitor for unauthenticated requests to bmx7-info from external or non-management network segments
Monitoring Recommendations
- Enable verbose logging on the OpenWrt LuCI web server and forward logs to a centralized analytics platform
- Baseline expected query parameters for the bmx7-info endpoint and alert on deviations
- Restrict LuCI management interface exposure to trusted management VLANs and audit access regularly
How to Mitigate CVE-2026-69095
Immediate Actions Required
- Update luci-app-bmx7 to a build containing commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd or later
- Restrict network access to the LuCI web interface using firewall rules that limit management access to trusted hosts
- Audit web server access logs for prior exploitation attempts against the bmx7-info endpoint
Patch Information
The OpenWrt LuCI project addressed the vulnerability in commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd. Administrators should rebuild or upgrade the luci-app-bmx7 package to include this commit. Refer to the GitHub Security Advisory GHSA-8qcq-jgrj-gvmj for the authoritative fix reference.
Workarounds
- Remove or disable the luci-app-bmx7 package on devices that do not require the bmx7 mesh routing interface
- Block external access to the LuCI web interface at the network perimeter until the patch is applied
- Deploy a reverse proxy or web application firewall rule that rejects requests to bmx7-info containing traversal sequences such as ../, ..%2f, or %2e%2e/
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
