{"vulnerability": "cve-2026-72841", "sightings": [{"uuid": "f3dc7c47-a17c-4c8e-aa48-0430f769b69b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-72841", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117093395688600672", "content": "CVE-2026-72841 (CRITICAL, CVSS 9.4) affects OpenWrt luci-app-openvpn: improper instance_name2 validation enables path traversal and arbitrary file writes, risking persistent root code execution. Restrict access & monitor uploads. https://radar.offseq.com/threat/cve-2026-72841-external-control-of-file-name-or-path-in-openwrt-luci-109c1361849edb55 #OffSeq #OpenWrt #Vuln", "creation_timestamp": "2026-08-14T10:30:26.188652Z"}, {"uuid": "5c4720fc-9a57-4274-96dd-424587ebc18e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-72841", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mszxbl6ydh2f", "content": "CVE-2026-72841 (CRITICAL): OpenWrt luci-app-openvpn flaw lets authenticated users write files anywhere via path traversal, risking persistent root access. Restrict user access & monitor uploads until patched. https://radar.offseq.com/threat/cve-2026-72841-external-control-of-file-name-or-path-in-...", "creation_timestamp": "2026-08-14T10:30:27.892510Z"}, {"uuid": "75876247-295b-4ece-abea-b634fa414e56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72841", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mtcw3d6yt62v", "content": "Critical CVE landed today in OpenVPN:\n\nCVE-2026-72841. luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intende\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-72841", "creation_timestamp": "2026-08-18T00:03:01.637715Z"}, {"uuid": "f0a600b3-36f9-436c-86c9-8ab67de51242", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72841", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msyq56elrd2u", "content": "CVE-2026-72841 - luci\nAuthenticated users can upload malicious files to gain root access. This happens because the system doesn't properly check where uploaded files are saved. To fix this, administrators\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#luci #openwrt #CVE #infosec", "creation_timestamp": "2026-08-13T22:50:03.965404Z"}]}