luci-app-openvpn fails to validate the instance_name2 parameter during file upload, enabling an authenticated user to perform path traversal and write arbitrary files outside the intended directory. The attacker can place malicious payloads, such as SSH keys, in system directories that persist across reboots, granting persistent root code execution. This flaw is represented by CWE-73 and carries a CVSS score of 9.4, indicating critical severity.

The vulnerability affects the OpenWrt luci web interface, specifically the luci-app-openvpn package, which accepts the instance_name2 file upload parameter. No specific product versions are listed in the data, so any installation of luci-app-openvpn that processes instance_name2 uploads is potentially vulnerable.

With a CVSS score of 9.4, the risk is high. Although the EPSS score is not available and the vulnerability is not listed in CISA KEV, the requirement for authenticated access to the luci interface means that users who can log in pose a significant threat. An attacker can exploit the flaw by uploading a crafted file that traverses directories, writing arbitrary code or credentials, and achieving persistent root privileges. The absence of an official patch or workaround in the current data highlights the urgency of remediation.