The Windows interactive service of OpenVPN releases 2.4.0 through 2.6.22 contains a flaw in how it validates file paths for configuration files. The service accepts relative and absolute paths that are not properly sanitized, allowing a local authenticated user to construct a path that points outside the designated trusted configuration directory. By placing a file with a crafted name in such a location, an attacker can overwrite or replace critical configuration files or inject malicious settings, potentially giving the attacker control over the OpenVPN process or its operation.

All Windows installations of OpenVPN from version 2.4.0 up to and including 2.6.22 are affected. The vulnerability applies to any local user account that has permission to interact with the OpenVPN interactive service and can write to the trusted configuration directory.

The CVSS score of 5.6 indicates a moderate risk. The flaw requires local authenticated access, meaning it cannot be exploited remotely without prior user interaction. An EPSS score of <1% shows a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The path traversal weakness (CWE‑22 and CWE‑73) can lead to overwriting configuration files, which could allow local privileged escalation or reconfiguration of the OpenVPN service.