Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-69095

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query string to escape the intended directory and read sensitive files accessible to the CGI process.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:ab751b199c1d0856293107795f4992321ee1f36eb8912acd24a980fc6cb30ae0
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

cvss · 2 assertions

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:b9ccf2051418d7aa2c2e190c326d1e14ef7b9e5cb5b9e8c1cbc2eaed80f6553f · sha256:fddc71ae20e6e872… · /containers/cna/metrics/1/cvssV3_1

{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"…

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:b9ccf2051418d7aa2c2e190c326d1e14ef7b9e5cb5b9e8c1cbc2eaed80f6553f · sha256:fddc71ae20e6e872… · /containers/cna/metrics/0/cvssV4_0

Affected products and versions

1 source assertion
{"defaultStatus":"unaffected","product":"luci","vendor":"openwrt","versions":[{"lessThan":"5890760a454dad2cb00389dba2cdc5e779e0ffdd","status":"affected","version":"0","versionType":"git"},{"status":"unaffected","version":"5890760a454dad2cb00389dba2cdc5e779e0ffdd","versionType":"git"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:b9ccf2051418d7aa2c2e190c326d1e14ef7b9e5cb5b9e8c1cbc2eaed80f6553f · sha256:fddc71ae20e6e872… · /containers/cna/affected/0

Provider-owned CVSS observations

2 source assertions
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:b9ccf2051418d7aa2c2e190c326d1e14ef7b9e5cb5b9e8c1cbc2eaed80f6553f · sha256:fddc71ae20e6e872… · /containers/cna/metrics/1/cvssV3_1
{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"…
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:b9ccf2051418d7aa2c2e190c326d1e14ef7b9e5cb5b9e8c1cbc2eaed80f6553f · sha256:fddc71ae20e6e872… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-22","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:b9ccf2051418d7aa2c2e190c326d1e14ef7b9e5cb5b9e8c1cbc2eaed80f6553f · sha256:fddc71ae20e6e872… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions
{"tags":["exploit"],"url":"https://github.com/openwrt/luci/security/advisories/GHSA-8qcq-jgrj-gvmj"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:b9ccf2051418d7aa2c2e190c326d1e14ef7b9e5cb5b9e8c1cbc2eaed80f6553f · sha256:fddc71ae20e6e872… · /containers/adp/0/references/0
{"name":"GitHub Security Advisory (GHSA-8qcq-jgrj-gvmj)","tags":["vendor-advisory"],"url":"https://github.com/openwrt/luci/security/advisories/GHSA-8qcq-jgrj-gvmj"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:b9ccf2051418d7aa2c2e190c326d1e14ef7b9e5cb5b9e8c1cbc2eaed80f6553f · sha256:fddc71ae20e6e872… · /containers/cna/references/0
{"name":"VulnCheck Advisory: OpenWrt luci-app-bmx7 Path Traversal via bmx7-info","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/openwrt-luci-app-bmx7-path-traversal-via-bmx7-info"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:b9ccf2051418d7aa2c2e190c326d1e14ef7b9e5cb5b9e8c1cbc2eaed80f6553f · sha256:fddc71ae20e6e872… · /containers/cna/references/1

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer