What’s Vulnerable › Vulnerabilities

CVE-2026-69095: OpenWrt luci-app-bmx7 Path Traversal via bmx7-info

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-03 · updated 2026-10-23
• Weakness: CWE-22

Description

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query string to escape the intended directory and read sensitive files accessible to the CGI process.

References

• https://github.com/openwrt/luci/security/advisories/GHSA-8qcq-jgrj-gvmj
• https://www.vulncheck.com/advisories/openwrt-luci-app-bmx7-path-traversal-via-bmx7-info
• https://github.com/openwrt/luci/security/advisories/GHSA-8qcq-jgrj-gvmj

Get alerted when CVE-2026-69095 or the next vulnerability affects your stack